Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Payload.exe

Overview

General Information

Sample name:Payload.exe
Analysis ID:1555217
MD5:a0044986eec99f4b05358f1457be6ee8
SHA1:bed5076d966b94c942487fd04e7074e861235ba2
SHA256:24c7c6cc3124b20c717ac485e263193e351f0ab2e672b353b38688ba218bda9a
Infos:

Detection

Python Stealer, BLX Stealer, XLABB Grabber
Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected BLX Stealer
Yara detected XLABB Grabber
AI detected suspicious sample
Drops PE files to the startup folder
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal communication platform credentials (via file / registry access)
Yara detected Generic Python Stealer
AV process strings found (often used to terminate AV products)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • Payload.exe (PID: 6416 cmdline: "C:\Users\user\Desktop\Payload.exe" MD5: A0044986EEC99F4B05358F1457BE6EE8)
    • Payload.exe (PID: 6612 cmdline: "C:\Users\user\Desktop\Payload.exe" MD5: A0044986EEC99F4B05358F1457BE6EE8)
      • cmd.exe (PID: 6676 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7000 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 6008 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 3760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 5012 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
  • Payload.exe (PID: 6800 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe" MD5: A0044986EEC99F4B05358F1457BE6EE8)
    • Payload.exe (PID: 3704 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe" MD5: A0044986EEC99F4B05358F1457BE6EE8)
      • cmd.exe (PID: 5904 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7032 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 3164 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 3568 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_XLABBGrabberYara detected XLABB GrabberJoe Security
    00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_BLXStealerYara detected BLX StealerJoe Security
      0000000D.00000002.3690395576.000002A26F240000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_XLABBGrabberYara detected XLABB GrabberJoe Security
        0000000D.00000002.3690395576.000002A26F240000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_BLXStealerYara detected BLX StealerJoe Security
          Process Memory Space: Payload.exe PID: 6612JoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security
            Click to see the 3 entries

            Sigma Signatures

            Sigma detected: Startup Folder File Write
            Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\Payload.exe, ProcessId: 6612, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-11-13T15:59:15.003634+010020229301A Network Trojan was detected172.202.163.200443192.168.2.449732TCP
            2024-11-13T15:59:53.633022+010020229301A Network Trojan was detected172.202.163.200443192.168.2.449793TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: Payload.exeAvira: detected
            Multi AV Scanner detection for submitted file
            Source: Payload.exeReversingLabs: Detection: 58%
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 81.0% probability
            Source: Payload.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063412060.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: cryptography_rust.pdbc source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: Payload.exe, 0000000C.00000003.2059571201.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: Payload.exe, 00000000.00000003.1839189648.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059270943.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061657930.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062418693.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060408560.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062626198.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2059956272.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Payload.exe, 00000000.00000003.1835590847.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2049930758.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062219654.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062418693.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060778643.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: Payload.exe, 00000000.00000003.1839001201.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059042237.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063858476.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061758960.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060666720.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2053217280.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061013716.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059483913.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062219654.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063858476.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb** source: Payload.exe, 0000000D.00000002.3722558012.00007FFDFFB50000.00000002.00000001.01000000.0000005F.sdmp
            Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2059798725.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061657930.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: Payload.exe, 0000000C.00000003.2061528722.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060666720.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb source: Payload.exe, 0000000D.00000002.3721942877.00007FFDFFADC000.00000002.00000001.01000000.00000061.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2054593515.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3720321686.00007FFDFA796000.00000002.00000001.01000000.00000067.sdmp
            Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063014790.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Payload.exe, 00000000.00000003.1835438176.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2049682826.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: Payload.exe, 0000000C.00000003.2060294282.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061274932.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063732239.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: Payload.exe, 0000000C.00000003.2060887502.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: Payload.exe, 00000000.00000003.1839189648.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059270943.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060181236.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060294282.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060554410.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Payload.exe, 0000000C.00000003.2078830560.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3724256302.00007FFE1A4F3000.00000002.00000001.01000000.0000005C.sdmp
            Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063014790.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061151360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: Payload.exe, 00000000.00000003.1839001201.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059042237.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063186076.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057815992.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3701223012.00007FFDF8512000.00000002.00000001.01000000.0000008C.sdmp
            Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063982918.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060066285.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061400403.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb source: Payload.exe, 0000000D.00000002.3722558012.00007FFDFFB50000.00000002.00000001.01000000.0000005F.sdmp
            Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061151360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdb source: Payload.exe, 00000001.00000002.3703248378.00007FFDFAC05000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062626198.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063732239.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062776082.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060408560.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: Payload.exe, 00000001.00000002.3705639389.00007FFDFAFF2000.00000002.00000001.01000000.00000016.sdmp
            Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063596360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Payload.exe, 00000000.00000003.1835438176.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2049682826.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2053951617.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061929014.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059956272.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061400403.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062904631.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059798725.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3720136912.00007FFDFA777000.00000002.00000001.01000000.00000069.sdmp
            Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2059377948.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060778643.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2059483913.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061528722.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063186076.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062120635.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061929014.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: Payload.exe, 00000000.00000003.1839101463.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059151077.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050945765.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3724039172.00007FFE11BED000.00000002.00000001.01000000.00000059.sdmp
            Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059377948.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: cryptography_rust.pdb source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Payload.exe, 00000000.00000003.1835590847.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2049930758.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063596360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062120635.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Payload.exe, 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: Payload.exe, 00000001.00000002.3705639389.00007FFDFAFF2000.00000002.00000001.01000000.00000016.sdmp
            Source: Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061013716.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059571201.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: Payload.exe, 00000000.00000003.1839101463.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059151077.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062028496.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: Payload.exe, 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmp, Payload.exe, 0000000D.00000002.3710533543.00007FFDF8FDE000.00000002.00000001.01000000.0000006E.sdmp
            Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062904631.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060066285.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062776082.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063982918.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061758960.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061274932.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: Payload.exe, 00000001.00000002.3703248378.00007FFDFAC05000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: Payload.exe, 0000000C.00000003.2059688565.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2053217280.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060181236.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2055776896.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060554410.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063412060.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: Payload.exe, 0000000C.00000003.2060887502.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb}},GCTL source: Payload.exe, 0000000D.00000002.3721942877.00007FFDFFADC000.00000002.00000001.01000000.00000061.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Payload.exe, 00000001.00000002.3684672980.000001BB2F560000.00000002.00000001.01000000.00000007.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062028496.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B49280 FindFirstFileExW,FindClose,0_2_00007FF6D3B49280
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B483C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6D3B483C0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B61874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6D3B61874
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B49280 FindFirstFileExW,FindClose,1_2_00007FF6D3B49280
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B483C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,1_2_00007FF6D3B483C0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B61874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF6D3B61874
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B409280 FindFirstFileExW,FindClose,12_2_00007FF71B409280
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B4083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,12_2_00007FF71B4083C0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B421874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,12_2_00007FF71B421874
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
            Source: Joe Sandbox ViewIP Address: 172.67.74.152 172.67.74.152
            Source: Joe Sandbox ViewIP Address: 172.67.74.152 172.67.74.152
            Source: unknownDNS query: name: api.ipify.org
            Source: unknownDNS query: name: api.ipify.org
            Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49732
            Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49793
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficDNS traffic detected: DNS query: api.ipify.org
            Source: Payload.exe, 00000001.00000002.3691098089.000001BB33290000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3690859188.000002A26F340000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
            Source: Payload.exe, 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://.css
            Source: Payload.exe, 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://.jpg
            Source: Payload.exe, 00000001.00000002.3690163722.000001BB32E90000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689962769.000002A26EF40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython27
            Source: Payload.exe, 00000001.00000002.3692076601.000001BB33AB0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689454448.000001BB32BED000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33E47000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33DF1000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689170720.000001BB32A75000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692167056.000001BB33B65000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB3271C000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689029039.000002A26EB61000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FEC2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
            Source: Payload.exe, 00000001.00000002.3691223035.000001BB33390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691029912.000002A26F440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue23606)
            Source: Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2053217280.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
            Source: Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.cod
            Source: Payload.exe, 00000000.00000003.1838407896.00000178B86D0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057815992.000001F0B2903000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
            Source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: Payload.exe, 00000000.00000003.1838407896.00000178B86D0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057815992.000001F0B2903000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: Payload.exe, 00000001.00000002.3691223035.000001BB33390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691029912.000002A26F440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations
            Source: Payload.exe, 00000001.00000003.1888805316.000001BB315FC000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1877194604.000001BB316BC000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1888805316.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1877497191.000001BB316E6000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3155D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875469225.000001BB316C4000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2103785691.000002A26DBDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
            Source: Payload.exe, 00000001.00000003.1875114007.000001BB31AE9000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875114007.000001BB31A81000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3155D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875435160.000001BB31AF8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875629440.000001BB31564000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3684768211.000001BB2F5F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688294290.000002A26E721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB3268F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl1
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlgoc
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688294290.000002A26E721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlp
            Source: Payload.exe, 00000000.00000003.1838407896.00000178B86D0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057815992.000001F0B2903000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
            Source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: Payload.exe, 0000000C.00000003.2053217280.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
            Source: Payload.exe, 00000001.00000002.3692076601.000001BB33AB0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB3271C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33DF1000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689454448.000001BB32BED000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689170720.000001BB32A75000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692167056.000001BB33B65000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689029039.000002A26EB61000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
            Source: Payload.exe, 00000001.00000002.3692076601.000001BB33AB0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3694770881.000001BB35554000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691223035.000001BB33390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3694770881.000001BB35574000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3694556521.000001BB35450000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691466187.000001BB33590000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3694394745.000001BB35350000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691098089.000001BB33290000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691343035.000001BB33490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DE70000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691152828.000002A26F540000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691029912.000002A26F440000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691276421.000002A26F650000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689029039.000002A26EB61000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FDC1000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3690859188.000002A26F340000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FEC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
            Source: Payload.exe, 00000001.00000002.3691098089.000001BB33290000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3690859188.000002A26F340000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
            Source: Payload.exe, 00000001.00000002.3690747143.000001BB33090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
            Source: Payload.exe, 00000001.00000002.3690747143.000001BB33090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
            Source: Payload.exe, 00000001.00000002.3690321175.000001BB32F90000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3690102416.000002A26F040000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
            Source: Payload.exe, 00000001.00000002.3687707547.000001BB320B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687451811.000001BB31E90000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875548653.000001BB31A19000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875469225.000001BB316B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31B45000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2115108381.000002A26E74A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688294290.000002A26E721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
            Source: Payload.exe, 00000001.00000002.3687451811.000001BB31E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
            Source: Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31CC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB32742000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB326A8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
            Source: Payload.exe, 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://html4/loose.dtd
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/post
            Source: Payload.exe, 00000001.00000002.3691466187.000001BB33590000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691276421.000002A26F650000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
            Source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: Payload.exe, 00000000.00000003.1838407896.00000178B86D0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057815992.000001F0B2903000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
            Source: Payload.exe, 00000000.00000003.1838407896.00000178B86D0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057815992.000001F0B2903000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
            Source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
            Source: Payload.exe, 00000001.00000002.3687451811.000001BB31E90000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687325108.000001BB31D90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opensource.org/licenses/BSD-3-Clause
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python-lz4.readthedocs.io/en/latest/
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python-lz4.readthedocs.io/en/stable/
            Source: Payload.exe, 00000001.00000002.3691864276.000001BB339B2000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org/
            Source: Payload.exe, 00000001.00000002.3691864276.000001BB339B2000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org:80
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3686554442.000001BB31B45000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/7
            Source: Payload.exe, 00000001.00000002.3688041311.000001BB32390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687966279.000002A26E440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/19622133/
            Source: Payload.exe, 00000001.00000002.3694556521.000001BB35450000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://timgolden.me.uk/python/wmi.html
            Source: Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB3271C000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
            Source: Payload.exe, 00000001.00000002.3694770881.000001BB35554000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33E47000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3694556521.000001BB35450000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691466187.000001BB33590000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691276421.000002A26F650000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33E47000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FEC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
            Source: Payload.exe, 00000001.00000002.3691098089.000001BB33290000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3690859188.000002A26F340000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692136441.000002A26FC14000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlC
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
            Source: Payload.exe, 00000001.00000002.3687325108.000001BB31D90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/vg
            Source: Payload.exe, 00000001.00000003.1875114007.000001BB31A81000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873705923.000001BB31A2A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873705923.000001BB31A7D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33E47000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB3271C000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FEC2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
            Source: Payload.exe, 00000001.00000002.3691343035.000001BB33490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691152828.000002A26F540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dabeaz.com/ply)
            Source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28FE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2071353785.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB3268F000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB326A8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
            Source: Payload.exe, 00000001.00000003.1875114007.000001BB31A81000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873705923.000001BB31A7D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
            Source: Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FDC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
            Source: Payload.exe, 00000001.00000003.1875114007.000001BB31A81000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873705923.000001BB31A2A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873705923.000001BB31A7D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688294290.000002A26E721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB326A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692136441.000002A26FC14000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33E47000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FEC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689993388.000001BB32D40000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://127.0.0.1:8443
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://aliexpress.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
            Source: Payload.exe, 0000000D.00000002.3694965313.000002A271850000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.myip.com
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.myip.comot-info
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://binance.com)
            Source: Payload.exe, 00000001.00000002.3689547389.000001BB32C46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://brew.sh
            Source: Payload.exe, 00000001.00000002.3692167056.000001BB33B1A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.py
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3693641952.000001BB34A80000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692167056.000001BB33B1A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue37179
            Source: Payload.exe, 00000001.00000002.3688041311.000001BB32390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687707547.000001BB320B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687966279.000002A26E440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
            Source: Payload.exe, 00000001.00000002.3694099874.000001BB35150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/1207404349177724988/1247483882857828352/Picsart_24-06-04_12-3
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/avatars/
            Source: Payload.exe, 0000000D.00000002.3716644790.00007FFDFA3BB000.00000002.00000001.01000000.00000071.sdmpString found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://codecov.io/gh/python-lz4/python-lz4
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://codecov.io/gh/python-lz4/python-lz4/branch/codecov/graph/badge.svg
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://coinbase.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crunchyroll.com)
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/changelog/
            Source: Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmpString found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
            Source: Payload.exe, 00000001.00000002.3691715331.000001BB338B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691508373.000002A26F970000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/hazmat/
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/installation/
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/security/
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689993388.000001BB32D40000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
            Source: Payload.exe, 00000001.00000002.3689993388.000001BB32D40000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3
            Source: Payload.exe, 00000001.00000002.3691715331.000001BB338B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691508373.000002A26F970000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com)
            Source: Payload.exe, 00000001.00000002.3694394745.000001BB35350000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/guilds/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/users/
            Source: Payload.exe, 00000001.00000002.3694099874.000001BB35150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v
            Source: Payload.exe, 00000001.00000002.3694099874.000001BB35150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v10
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/users/
            Source: Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3694556521.000001BB35450000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/
            Source: Payload.exe, 00000001.00000002.3690747143.000001BB33090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/1297535549556396133/ve261trT7MNuWrlMT1bnnjDbtyFOhfHK7UO0xzUt7Hpz9EX
            Source: Payload.exe, 0000000D.00000002.3694048579.000002A271310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/channels/
            Source: Payload.exe, 00000001.00000002.3694099874.000001BB35150000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/developers/applications/
            Source: Payload.exe, 00000001.00000002.3694099874.000001BB35150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/events/
            Source: Payload.exe, 00000001.00000002.3693947132.000001BB35040000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/oauth2/authorize?client_id=
            Source: Payload.exe, 00000001.00000002.3694099874.000001BB35150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.gg
            Source: Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.ggN
            Source: Payload.exe, 00000001.00000002.3694556521.000001BB35450000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.new/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discordapp.com/api/v6/users/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://disney.com)
            Source: Payload.exe, 00000001.00000002.3692167056.000001BB33B1A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/clienQ;
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FDC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#client-tracing
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3693641952.000001BB34A80000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
            Source: Payload.exe, 00000001.00000002.3685967283.000001BB31550000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
            Source: Payload.exe, 00000001.00000002.3689859176.000001BB32C71000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/howto/mro.html
            Source: Payload.exe, 00000001.00000002.3693641952.000001BB34A80000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
            Source: Payload.exe, 00000001.00000002.3685123722.000001BB30EE0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3685355738.000002A26D070000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
            Source: Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685553670.000001BB31130000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
            Source: Payload.exe, 00000001.00000002.3685123722.000001BB30EE0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3685355738.000002A26D070000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
            Source: Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685123722.000001BB30F68000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
            Source: Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685123722.000001BB30F68000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
            Source: Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685553670.000001BB31130000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
            Source: Payload.exe, 00000001.00000002.3685123722.000001BB30EE0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3685355738.000002A26D070000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
            Source: Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685553670.000001BB31130000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
            Source: Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3684768211.000001BB2F5F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2091404363.000002A26B69D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2090283179.000002A26B6A0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3684401189.000002A26B639000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
            Source: Payload.exe, 00000001.00000002.3685675984.000001BB31346000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2098713343.000002A26D884000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2099043654.000002A26D884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1888720972.000001BB31A88000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1889095317.000001BB31D0F000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1888720972.000001BB31A88000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1889095317.000001BB31D0F000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
            Source: Payload.exe, 00000001.00000003.1882892267.000001BB32591000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2111006559.000002A26DC83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
            Source: Payload.exe, 00000001.00000003.1876464206.000001BB31BDE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1882931783.000001BB31D4A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688041311.000001BB32390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1876464206.000001BB31B76000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1882892267.000001BB32591000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687966279.000002A26E440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
            Source: Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FDC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.rs/regex/latest/regex/#syntax
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ebay.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://epicgames.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://expressvpn.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://file.io
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://filepreviews.io/
            Source: Payload.exe, 00000001.00000002.3690747143.000001BB33090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
            Source: Payload.exe, 00000001.00000003.1877625811.000001BB31B45000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1878743429.000001BB31B45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d9
            Source: Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688156970.000001BB32490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2111006559.000002A26DC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
            Source: Payload.exe, 00000001.00000002.3694099874.000001BB35150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rapptz/discord.py
            Source: Payload.exe, 00000001.00000002.3691466187.000001BB33590000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691343035.000001BB33490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691152828.000002A26F540000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691276421.000002A26F650000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ThomasHabets/arping
            Source: Payload.exe, 00000001.00000002.3685675984.000001BB31330000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3684768211.000001BB2F5F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2091404363.000002A26B69D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2090283179.000002A26B6A0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3684401189.000002A26B639000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3693641952.000001BB34A80000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692167056.000001BB33B1A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
            Source: Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691343035.000001BB33490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691152828.000002A26F540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/borisbabic/browser_cookie3/issues/new
            Source: Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/borisbabic/browser_cookie3/issues/newPa
            Source: Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/borisbabic/browser_cookie3/issues/newPas3
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692167056.000001BB33B65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/freyacodes/Lavalink
            Source: Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
            Source: Payload.exe, 00000001.00000002.3688156970.000001BB32490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687451811.000001BB31E90000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2103785691.000002A26DBDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lz4/lz4/blob/dev/doc/lz4_Block_format.md
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lz4/lz4/blob/master/doc/lz4_Frame_format.md
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lz4/lz4/blob/master/examples/streaming_api_basics.md
            Source: Payload.exe, 00000000.00000003.1835112277.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2078160853.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2078470286.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2048637747.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3722192742.00007FFDFFB24000.00000002.00000001.01000000.00000061.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
            Source: Payload.exe, 00000001.00000002.3691223035.000001BB33390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691029912.000002A26F440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
            Source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/8996
            Source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/9253
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
            Source: Payload.exe, 00000001.00000002.3688041311.000001BB32390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687966279.000002A26E440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
            Source: Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687966279.000002A26E440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging02d2
            Source: Payload.exe, 00000001.00000002.3688041311.000001BB32390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging62d2
            Source: Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
            Source: Payload.exe, 00000001.00000002.3686447175.000001BB31870000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
            Source: Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
            Source: Payload.exe, 00000001.00000002.3689859176.000001BB32C71000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/136
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB3268F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/251
            Source: Payload.exe, 00000001.00000002.3689859176.000001BB32C71000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/428
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-lz4/python-lz4
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-lz4/python-lz4/actions/workflows/build_dist.yml
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-lz4/python-lz4/actions/workflows/build_dist.yml/badge.svg
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-lz4/python-lz4/issues
            Source: Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685123722.000001BB30F68000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
            Source: Payload.exe, 0000000D.00000002.3684401189.000002A26B639000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
            Source: Payload.exe, 00000001.00000002.3685675984.000001BB31330000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3684768211.000001BB2F5F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2091404363.000002A26B69D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2090283179.000002A26B6A0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3684401189.000002A26B639000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
            Source: Payload.exe, 00000001.00000003.1871919658.000001BB3168E000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1872546038.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1877194604.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1870123075.000001BB316E4000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873901840.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875629440.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1888805316.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1870422272.000001BB31696000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1870785804.000001BB31696000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1870383769.000001BB316E4000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2093949784.000002A26D85F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3693641952.000001BB34A80000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692167056.000001BB33B1A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/28073
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/hynek
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/hynek).
            Source: Payload.exe, 00000001.00000002.3685675984.000001BB31330000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3684768211.000001BB2F5F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2091404363.000002A26B69D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2090283179.000002A26B6A0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3684401189.000002A26B639000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
            Source: Payload.exe, 00000001.00000002.3690747143.000001BB33090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920n
            Source: Payload.exe, 00000001.00000002.3691098089.000001BB33290000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3690859188.000002A26F340000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gmail.com)
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hbo.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hotmail.com)
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688294290.000002A26E721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
            Source: Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
            Source: Payload.exe, 0000000D.00000002.3690859188.000002A26F340000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB326A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hynek.me/articles/import-attrs/)
            Source: Payload.exe, 00000001.00000002.3694241619.000001BB35250000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3694048579.000002A271310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://i.scdn.co/image/
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
            Source: Payload.exe, 00000001.00000003.1873901840.000001BB316C4000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1872546038.000001BB316C4000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1871919658.000001BB316C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/late
            Source: Payload.exe, 00000001.00000003.1871919658.000001BB316C4000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687325108.000001BB31D90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://instagram.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/
            Source: Payload.exe, 0000000D.00000002.3686590415.000002A26DE70000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2115108381.000002A26E74A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://klaviyo.com/
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lz4.github.io/lz4/
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31D0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
            Source: Payload.exe, 00000001.00000002.3694241619.000001BB35250000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3694048579.000002A271310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://media.discordapp.net/
            Source: Payload.exe, 00000001.00000002.3694241619.000001BB35250000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3694048579.000002A271310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://media.discordapp.net/stickers/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://minecraft.net)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://netflix.com)
            Source: Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33E47000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3155D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
            Source: Payload.exe, 00000001.00000002.3694241619.000001BB35250000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3694048579.000002A271310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://open.spotify.com/track/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://origin.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://outlook.com)
            Source: Payload.exe, 00000001.00000002.3691466187.000001BB33590000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691343035.000001BB33490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691152828.000002A26F540000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691276421.000002A26F650000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packages.debian.org/sid/iputils-arping
            Source: Payload.exe, 00000001.00000003.1889642878.000001BB32652000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1889095317.000001BB31D0F000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3686554442.000001BB31D0D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1890145261.000001BB31D0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
            Source: Payload.exe, 00000001.00000002.3688156970.000001BB32490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687707547.000001BB320B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://paypal.com)
            Source: Payload.exe, 00000001.00000003.1868860452.000001BB315D7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685855881.000001BB31450000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1869275423.000001BB315D7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1868282039.000001BB315D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0649/)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0749/)-implementing
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://playstation.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pornhub.com)
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB328B3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692167056.000001BB33B65000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692136441.000002A26FC48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://projectfluent.org
            Source: Payload.exe, 00000001.00000002.3691864276.000001BB339B2000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pyopenssl.org/
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/attrs/)
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/cryptography/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/blxsi/asdasdas/main/inject.js
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
            Source: Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/python-lz4/
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/python-lz4/badge/?version=stable
            Source: Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1877625811.000001BB31B45000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688156970.000001BB32490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1878743429.000001BB31B45000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2111006559.000002A26DC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
            Source: Payload.exe, 00000001.00000002.3691223035.000001BB33390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB326A8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691029912.000002A26F440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
            Source: Payload.exe, 00000001.00000002.3691223035.000001BB33390000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.ioPp?3
            Source: Payload.exe, 0000000D.00000002.3691029912.000002A26F440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.ioPpJo
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://riotgames.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://roblox.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellix.io)
            Source: Payload.exe, 00000001.00000003.1874334145.000001BB3156B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1872427392.000001BB31A7D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1872427392.000001BB31A26000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3155D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875629440.000001BB31564000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2108150942.000002A26D771000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2104857939.000002A26D771000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
            Source: Payload.exe, 00000001.00000002.3687707547.000001BB320B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://spotify.com)
            Source: Payload.exe, 00000001.00000003.1889095317.000001BB31B85000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1876464206.000001BB31BDE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1879594088.000001BB31BA1000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1882931783.000001BB31D4A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3686554442.000001BB31B45000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1888805316.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1876464206.000001BB31B76000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3155D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1882892267.000001BB32591000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2111006559.000002A26DC83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
            Source: Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://steam.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://superfurrycdn.nl/copy/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://telegram.com)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tiktok.com)
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33DF1000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33E47000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB3271C000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FEC2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitch.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com)
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://uber.com)
            Source: Payload.exe, 00000001.00000002.3687325108.000001BB31D90000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687966279.000002A26E440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
            Source: Payload.exe, 00000001.00000002.3685675984.000001BB31346000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
            Source: Payload.exe, 0000000C.00000003.2068171030.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
            Source: Payload.exe, 0000000C.00000003.2068444697.000001F0B2906000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2068171030.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2068171030.000001F0B2905000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/latest/names.html)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/changelog.html
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
            Source: Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.github.com/python-lz4/python-lz4
            Source: Payload.exe, 00000001.00000002.3692686032.000001BB33E47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.t
            Source: Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33E47000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB326A8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FDC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688294290.000002A26E721000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.manpagez.com/man/8/networksetup/
            Source: Payload.exe, 00000001.00000002.3706081701.00007FFDFB133000.00000002.00000001.01000000.00000016.sdmp, Payload.exe, 00000001.00000002.3703528374.00007FFDFAC40000.00000002.00000001.01000000.00000015.sdmp, Payload.exe, 0000000C.00000003.2072972050.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3712125829.00007FFDF9503000.00000002.00000001.01000000.00000065.sdmpString found in binary or memory: https://www.openssl.org/H
            Source: Payload.exe, 00000001.00000002.3691715331.000001BB338B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689859176.000001BB32C71000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691508373.000002A26F970000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html
            Source: Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/docs/manmaster/man3/X509_verify_cert_error_string.html#ERROR-CODES
            Source: Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/docs/manmaster/man5/
            Source: Payload.exe, 00000001.00000002.3688335194.000001BB326A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31D0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
            Source: Payload.exe, 00000001.00000002.3685123722.000001BB30EE0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3685355738.000002A26D070000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
            Source: Payload.exe, 0000000D.00000002.3712947652.00007FFDF9938000.00000004.00000001.01000000.00000054.sdmpString found in binary or memory: https://www.python.org/psf/license/
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
            Source: Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.variomedia.de/
            Source: Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xbox.com)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com)
            Source: Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://youtube.com)
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
            Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
            Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B65C000_2_00007FF6D3B65C00
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B489E00_2_00007FF6D3B489E0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B669640_2_00007FF6D3B66964
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B608C80_2_00007FF6D3B608C8
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B410000_2_00007FF6D3B41000
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B55D300_2_00007FF6D3B55D30
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B4ACAD0_2_00007FF6D3B4ACAD
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B4A4740_2_00007FF6D3B4A474
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B52C100_2_00007FF6D3B52C10
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B63C100_2_00007FF6D3B63C10
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B664180_2_00007FF6D3B66418
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B608C80_2_00007FF6D3B608C8
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B51B500_2_00007FF6D3B51B50
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B4A2DB0_2_00007FF6D3B4A2DB
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B5DA5C0_2_00007FF6D3B5DA5C
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B539A40_2_00007FF6D3B539A4
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B519440_2_00007FF6D3B51944
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B521640_2_00007FF6D3B52164
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B580E40_2_00007FF6D3B580E4
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B640AC0_2_00007FF6D3B640AC
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B618740_2_00007FF6D3B61874
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B498000_2_00007FF6D3B49800
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B587940_2_00007FF6D3B58794
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B517400_2_00007FF6D3B51740
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B51F600_2_00007FF6D3B51F60
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B697280_2_00007FF6D3B69728
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B5DEF00_2_00007FF6D3B5DEF0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B65E7C0_2_00007FF6D3B65E7C
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B59EA00_2_00007FF6D3B59EA0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B535A00_2_00007FF6D3B535A0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B51D540_2_00007FF6D3B51D54
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B5E5700_2_00007FF6D3B5E570
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B65C001_2_00007FF6D3B65C00
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B669641_2_00007FF6D3B66964
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B410001_2_00007FF6D3B41000
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B55D301_2_00007FF6D3B55D30
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B4ACAD1_2_00007FF6D3B4ACAD
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B4A4741_2_00007FF6D3B4A474
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B52C101_2_00007FF6D3B52C10
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B63C101_2_00007FF6D3B63C10
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B664181_2_00007FF6D3B66418
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B608C81_2_00007FF6D3B608C8
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B51B501_2_00007FF6D3B51B50
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B4A2DB1_2_00007FF6D3B4A2DB
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B5DA5C1_2_00007FF6D3B5DA5C
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B489E01_2_00007FF6D3B489E0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B539A41_2_00007FF6D3B539A4
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B519441_2_00007FF6D3B51944
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B521641_2_00007FF6D3B52164
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B608C81_2_00007FF6D3B608C8
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B580E41_2_00007FF6D3B580E4
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B640AC1_2_00007FF6D3B640AC
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B618741_2_00007FF6D3B61874
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B498001_2_00007FF6D3B49800
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B587941_2_00007FF6D3B58794
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B517401_2_00007FF6D3B51740
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B51F601_2_00007FF6D3B51F60
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B697281_2_00007FF6D3B69728
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B5DEF01_2_00007FF6D3B5DEF0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B65E7C1_2_00007FF6D3B65E7C
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B59EA01_2_00007FF6D3B59EA0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B535A01_2_00007FF6D3B535A0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B51D541_2_00007FF6D3B51D54
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B5E5701_2_00007FF6D3B5E570
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7D23E01_2_00007FFDFA7D23E0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7D1FB01_2_00007FFDFA7D1FB0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7E48101_2_00007FFDFA7E4810
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7E45C01_2_00007FFDFA7E45C0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7F1FE01_2_00007FFDFA7F1FE0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7F1D701_2_00007FFDFA7F1D70
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7F24901_2_00007FFDFA7F2490
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7F35201_2_00007FFDFA7F3520
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7F29B01_2_00007FFDFA7F29B0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7F2EB01_2_00007FFDFA7F2EB0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA8021201_2_00007FFDFA802120
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA801D301_2_00007FFDFA801D30
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA8121E01_2_00007FFDFA8121E0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA811F001_2_00007FFDFA811F00
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA9918A01_2_00007FFDFA9918A0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAFB7101_2_00007FFDFAAFB710
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAABB3001_2_00007FFDFAABB300
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAE27001_2_00007FFDFAAE2700
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAC58F01_2_00007FFDFAAC58F0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAF08F01_2_00007FFDFAAF08F0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAE2AE01_2_00007FFDFAAE2AE0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAADC8E01_2_00007FFDFAADC8E0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAC47501_2_00007FFDFAAC4750
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAF7D501_2_00007FFDFAAF7D50
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAABC9401_2_00007FFDFAABC940
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAFC3401_2_00007FFDFAAFC340
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAE6F401_2_00007FFDFAAE6F40
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAABDF201_2_00007FFDFAABDF20
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAE46901_2_00007FFDFAAE4690
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAADE0901_2_00007FFDFAADE090
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAE12901_2_00007FFDFAAE1290
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAC7E701_2_00007FFDFAAC7E70
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAB20701_2_00007FFDFAAB2070
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAADB2701_2_00007FFDFAADB270
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAB786B1_2_00007FFDFAAB786B
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAFE8601_2_00007FFDFAAFE860
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAF76601_2_00007FFDFAAF7660
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAB66C01_2_00007FFDFAAB66C0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAE68C01_2_00007FFDFAAE68C0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAFFEB01_2_00007FFDFAAFFEB0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAF94B01_2_00007FFDFAAF94B0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAE0EB01_2_00007FFDFAAE0EB0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAF7AA01_2_00007FFDFAAF7AA0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAADA8101_2_00007FFDFAADA810
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFAAFF4001_2_00007FFDFAAFF400
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B425C0012_2_00007FF71B425C00
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B42696412_2_00007FF71B426964
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B4089E012_2_00007FF71B4089E0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B4208C812_2_00007FF71B4208C8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B40100012_2_00007FF71B401000
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B40A47412_2_00007FF71B40A474
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B42641812_2_00007FF71B426418
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B4208C812_2_00007FF71B4208C8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B40ACAD12_2_00007FF71B40ACAD
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B411B5012_2_00007FF71B411B50
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B423C1012_2_00007FF71B423C10
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B412C1012_2_00007FF71B412C10
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B41DA5C12_2_00007FF71B41DA5C
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B40A2DB12_2_00007FF71B40A2DB
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B41216412_2_00007FF71B412164
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B41194412_2_00007FF71B411944
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B4139A412_2_00007FF71B4139A4
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B42187412_2_00007FF71B421874
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B4180E412_2_00007FF71B4180E4
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B4240AC12_2_00007FF71B4240AC
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B411F6012_2_00007FF71B411F60
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B41879412_2_00007FF71B418794
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B42972812_2_00007FF71B429728
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B41174012_2_00007FF71B411740
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B40980012_2_00007FF71B409800
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B425E7C12_2_00007FF71B425E7C
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B41DEF012_2_00007FF71B41DEF0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B419EA012_2_00007FF71B419EA0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B41E57012_2_00007FF71B41E570
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B415D3012_2_00007FF71B415D30
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B411D5412_2_00007FF71B411D54
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B4135A012_2_00007FF71B4135A0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: String function: 00007FF71B402710 appears 52 times
            Source: C:\Users\user\Desktop\Payload.exeCode function: String function: 00007FF6D3B42710 appears 104 times
            Source: C:\Users\user\Desktop\Payload.exeCode function: String function: 00007FF6D3B42910 appears 34 times
            Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-interlocked-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-util-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-console-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-process-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-synch-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-timezone-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-file-l2-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-debug-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-profile-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-localization-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-datetime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-math-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-time-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-locale-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-file-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-file-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: python3.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-environment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-stdio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-processthreads-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-handle-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-synch-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-processthreads-l1-1-1.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-utility-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-conio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-convert-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-runtime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-crt-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: api-ms-win-core-memory-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
            Source: Payload.exe, 00000000.00000003.1835112277.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1836616255.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1835438176.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1838264282.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1836848416.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1839101463.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1835590847.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1838084483.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1839001201.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1839189648.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs Payload.exe
            Source: Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs Payload.exe
            Source: Payload.exeBinary or memory string: OriginalFilename vs Payload.exe
            Source: Payload.exe, 00000001.00000002.3706081701.00007FFDFB133000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs Payload.exe
            Source: Payload.exe, 00000001.00000002.3700453114.00007FFDFA980000.00000002.00000001.01000000.0000001F.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs Payload.exe
            Source: Payload.exe, 00000001.00000002.3703528374.00007FFDFAC40000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenamelibsslH vs Payload.exe
            Source: Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs Payload.exe
            Source: Payload.exe, 00000001.00000002.3684672980.000001BB2F560000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs Payload.exe
            Source: Payload.exe, 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2061151360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2051466429.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2078160853.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom311.dll0 vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2063186076.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2063982918.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2061657930.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2062418693.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2057470577.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2061929014.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2059377948.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2060554410.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2059798725.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2059688565.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2060887502.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2049930758.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2053951617.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2059483913.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2059042237.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2061013716.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2057815992.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2055776896.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2062904631.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2078830560.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2062219654.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2062776082.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2061528722.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2063596360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2054593515.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2063014790.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2060066285.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2051729554.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2061274932.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2062626198.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2075762488.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2060408560.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2063732239.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2050945765.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2072972050.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2059151077.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2078470286.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes311.dll0 vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2063412060.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2061758960.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2059956272.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2061400403.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2062120635.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2049682826.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2060666720.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2048637747.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2060294282.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2062028496.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2060778643.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2057067655.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2063858476.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2059270943.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2060181236.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2053217280.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs Payload.exe
            Source: Payload.exe, 0000000C.00000003.2059571201.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs Payload.exe
            Source: Payload.exeBinary or memory string: OriginalFilename vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3722192742.00007FFDFFB24000.00000002.00000001.01000000.00000061.sdmpBinary or memory string: OriginalFilenamepythoncom311.dll0 vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3717632415.00007FFDFA41A000.00000002.00000001.01000000.0000006D.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3721349938.00007FFDFFA3E000.00000002.00000001.01000000.00000066.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3712125829.00007FFDF9503000.00000002.00000001.01000000.00000065.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3724870467.00007FFE1A52B000.00000002.00000001.01000000.00000057.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3725074737.00007FFE1A547000.00000002.00000001.01000000.00000055.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3720210641.00007FFDFA77E000.00000002.00000001.01000000.00000069.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3723098262.00007FFDFFBD5000.00000002.00000001.01000000.0000005A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3720981947.00007FFDFA7C9000.00000002.00000001.01000000.00000063.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3722823991.00007FFDFFB9E000.00000002.00000001.01000000.0000005D.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3710653957.00007FFDF9010000.00000002.00000001.01000000.0000006E.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs Payload.exe
            Source: Payload.exe, 0000000D.00000002.3724338055.00007FFE1A4F6000.00000002.00000001.01000000.0000005C.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs Payload.exe
            Source: classification engineClassification label: mal96.troj.adwa.spyw.evad.winEXE@28/399@1/1
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeJump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3760:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2416:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2588:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4320:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_03
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162Jump to behavior
            Source: Payload.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\Payload.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
            Source: C:\Users\user\Desktop\Payload.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT action_url, username_value, password_value FROM logins;
            Source: Payload.exe, 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmp, Payload.exe, 0000000D.00000002.3710533543.00007FFDF8FDE000.00000002.00000001.01000000.0000006E.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
            Source: Payload.exe, 00000001.00000002.3691223035.000001BB33390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691029912.000002A26F440000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT host_key, path, is_secure, expires_utc, name, value, encrypted_value, is_httponly FROM cookies WHERE host_key like ?;
            Source: Payload.exe, 00000001.00000002.3691223035.000001BB33390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691029912.000002A26F440000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT host_key, path, secure, expires_utc, name, value, encrypted_value, is_httponly FROM cookies WHERE host_key like ?;
            Source: Payload.exe, 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmp, Payload.exe, 0000000D.00000002.3710533543.00007FFDF8FDE000.00000002.00000001.01000000.0000006E.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
            Source: Payload.exe, 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmp, Payload.exe, 0000000D.00000002.3710533543.00007FFDF8FDE000.00000002.00000001.01000000.0000006E.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
            Source: Payload.exe, 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmp, Payload.exe, 0000000D.00000002.3710533543.00007FFDF8FDE000.00000002.00000001.01000000.0000006E.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
            Source: Payload.exe, Payload.exe, 0000000D.00000002.3710533543.00007FFDF8FDE000.00000002.00000001.01000000.0000006E.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
            Source: Payload.exe, 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmp, Payload.exe, 0000000D.00000002.3710533543.00007FFDF8FDE000.00000002.00000001.01000000.0000006E.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
            Source: Payload.exe, 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmp, Payload.exe, 0000000D.00000002.3710533543.00007FFDF8FDE000.00000002.00000001.01000000.0000006E.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
            Source: Payload.exeReversingLabs: Detection: 58%
            Source: Payload.exeString found in binary or memory: can't send non-None value to a just-started generator
            Source: C:\Users\user\Desktop\Payload.exeFile read: C:\Users\user\Desktop\Payload.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\Payload.exe "C:\Users\user\Desktop\Payload.exe"
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Users\user\Desktop\Payload.exe "C:\Users\user\Desktop\Payload.exe"
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
            Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe"
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe"
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Users\user\Desktop\Payload.exe "C:\Users\user\Desktop\Payload.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuidJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe" Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: libffi-8.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: libcrypto-3.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: libssl-3.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: libcrypto-3.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: sqlite3.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: pdh.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: libffi-8.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: libcrypto-3.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: libssl-3.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: libcrypto-3.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: sqlite3.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: pdh.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
            Source: C:\Users\user\Desktop\Payload.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: Payload.exeStatic PE information: Image base 0x140000000 > 0x60000000
            Source: Payload.exeStatic file information: File size 26241148 > 1048576
            Source: Payload.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: Payload.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: Payload.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: Payload.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Payload.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: Payload.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: Payload.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: Payload.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063412060.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: cryptography_rust.pdbc source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: Payload.exe, 0000000C.00000003.2059571201.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: Payload.exe, 00000000.00000003.1839189648.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059270943.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061657930.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062418693.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060408560.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062626198.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2059956272.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Payload.exe, 00000000.00000003.1835590847.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2049930758.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062219654.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062418693.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060778643.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: Payload.exe, 00000000.00000003.1839001201.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059042237.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063858476.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061758960.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060666720.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2053217280.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061013716.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059483913.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062219654.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063858476.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb** source: Payload.exe, 0000000D.00000002.3722558012.00007FFDFFB50000.00000002.00000001.01000000.0000005F.sdmp
            Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2059798725.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061657930.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: Payload.exe, 0000000C.00000003.2061528722.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060666720.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb source: Payload.exe, 0000000D.00000002.3721942877.00007FFDFFADC000.00000002.00000001.01000000.00000061.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: Payload.exe, 00000000.00000003.1837740018.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2054593515.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3720321686.00007FFDFA796000.00000002.00000001.01000000.00000067.sdmp
            Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063014790.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Payload.exe, 00000000.00000003.1835438176.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2049682826.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: Payload.exe, 0000000C.00000003.2060294282.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061274932.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063732239.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: Payload.exe, 0000000C.00000003.2060887502.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: Payload.exe, 00000000.00000003.1839189648.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059270943.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060181236.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060294282.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060554410.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Payload.exe, 0000000C.00000003.2078830560.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3724256302.00007FFE1A4F3000.00000002.00000001.01000000.0000005C.sdmp
            Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063014790.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061151360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: Payload.exe, 00000000.00000003.1839001201.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059042237.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063186076.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: Payload.exe, 00000000.00000003.1838407896.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2057815992.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3701223012.00007FFDF8512000.00000002.00000001.01000000.0000008C.sdmp
            Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063982918.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060066285.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061400403.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb source: Payload.exe, 0000000D.00000002.3722558012.00007FFDFFB50000.00000002.00000001.01000000.0000005F.sdmp
            Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061151360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdb source: Payload.exe, 00000001.00000002.3703248378.00007FFDFAC05000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062626198.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063732239.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062776082.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060408560.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: Payload.exe, 00000001.00000002.3705639389.00007FFDFAFF2000.00000002.00000001.01000000.00000016.sdmp
            Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063596360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Payload.exe, 00000000.00000003.1835438176.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2049682826.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: Payload.exe, 00000000.00000003.1837657079.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2053951617.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061929014.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059956272.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061400403.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062904631.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059798725.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Payload.exe, 00000000.00000003.1837073321.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2052313066.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3720136912.00007FFDFA777000.00000002.00000001.01000000.00000069.sdmp
            Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2059377948.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060778643.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: Payload.exe, 00000000.00000003.1835719318.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050151967.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2059483913.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061528722.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063186076.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062120635.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061929014.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: Payload.exe, 00000000.00000003.1839101463.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059151077.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Payload.exe, 00000000.00000003.1836235257.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2050945765.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3724039172.00007FFE11BED000.00000002.00000001.01000000.00000059.sdmp
            Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059377948.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Payload.exe, 00000000.00000003.1837953219.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2056304174.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: cryptography_rust.pdb source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Payload.exe, 00000000.00000003.1835590847.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2049930758.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063596360.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062120635.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Payload.exe, 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: Payload.exe, 00000001.00000002.3705639389.00007FFDFAFF2000.00000002.00000001.01000000.00000016.sdmp
            Source: Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmp
            Source: Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2061013716.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2059571201.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: Payload.exe, 00000000.00000003.1839101463.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2059151077.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062028496.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: Payload.exe, 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmp, Payload.exe, 0000000D.00000002.3710533543.00007FFDF8FDE000.00000002.00000001.01000000.0000006E.sdmp
            Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2062904631.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060066285.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062776082.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2063982918.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061758960.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2061274932.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: Payload.exe, 00000001.00000002.3703248378.00007FFDFAC05000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: Payload.exe, 0000000C.00000003.2059688565.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Payload.exe, 00000000.00000003.1837516867.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2053217280.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: Payload.exe, 0000000C.00000003.2060181236.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Payload.exe, 00000000.00000003.1837856554.00000178B86C3000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2055776896.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2060554410.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2063412060.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: Payload.exe, 0000000C.00000003.2060887502.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb}},GCTL source: Payload.exe, 0000000D.00000002.3721942877.00007FFDFFADC000.00000002.00000001.01000000.00000061.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Payload.exe, 00000001.00000002.3684672980.000001BB2F560000.00000002.00000001.01000000.00000007.sdmp, Payload.exe, 0000000C.00000003.2075989694.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: Payload.exe, 0000000C.00000003.2062028496.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp
            Source: Payload.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: Payload.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: Payload.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: Payload.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: Payload.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: api-ms-win-core-console-l1-1-0.dll.0.drStatic PE information: 0x975A648E [Sun Jun 19 20:33:18 2050 UTC]
            Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
            Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
            Source: python311.dll.0.drStatic PE information: section name: PyRuntim
            Source: mfc140u.dll.0.drStatic PE information: section name: .didat
            Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_bz2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_websocket.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_websocket.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_helpers.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_helpers.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\propcache\_helpers_c.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\yarl\_quoting_c.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\VCRUNTIME140_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\VCRUNTIME140.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-file-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\ucrtbase.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_hashlib.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-util-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\unicodedata.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_decimal.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\python311.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_overlapped.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l2-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\libffi-8.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography\hazmat\bindings\_rust.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_ssl.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_socket.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\VCRUNTIME140_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_http_parser.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\lz4\block\_block.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_cffi_backend.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\pywin32_system32\pythoncom311.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-console-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-util-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\sqlite3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_http_parser.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\unicodedata.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-console-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\frozenlist\_frozenlist.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\multidict\_multidict.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\lz4\_version.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_curve448.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\sqlite3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_curve25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_socket.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32\pythoncom311.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_asyncio.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\libffi-8.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_brotli.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_curve25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\multidict\_multidict.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\yarl\_quoting_c.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-file-l2-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32\pywintypes311.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\VCRUNTIME140.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\psutil\_psutil_windows.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\libssl-3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-file-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_brotli.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_curve448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_overlapped.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\libcrypto-3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_uuid.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_ssl.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\psutil\_psutil_windows.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_http_writer.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_ctypes.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\pywin32_system32\pywintypes311.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography\hazmat\bindings\_rust.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_http_writer.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\libssl-3.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_queue.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\python311.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\lz4\block\_block.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\propcache\_helpers_c.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\frozenlist\_frozenlist.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\_cffi_backend.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\lz4\_version.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\ucrtbase.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_hashlib.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\libcrypto-3.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\_uuid.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68002\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_ghash_portable.pydJump to dropped file

            Boot Survival

            barindex
            Drops PE files to the startup folder
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B45830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF6D3B45830
            Source: C:\Users\user\Desktop\Payload.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
            Source: C:\Users\user\Desktop\Payload.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OLLYDBG.EXE
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: QEMU-GA.EXE
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMUSRVC.EXE
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXEIL-L1-1-0.DLL
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: FIDDLER.EXE
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: XENSERVICE.EXE
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: WIRESHARK.EXE
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_bz2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_websocket.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_websocket.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_helpers.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_helpers.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\propcache\_helpers_c.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\yarl\_quoting_c.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-file-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_hashlib.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-util-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\unicodedata.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_decimal.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\python311.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_overlapped.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l2-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography\hazmat\bindings\_rust.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_lzma.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_ssl.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_http_parser.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\lz4\block\_block.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_cffi_backend.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\pywin32_system32\pythoncom311.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-console-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-util-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_http_parser.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\unicodedata.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-console-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\frozenlist\_frozenlist.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\multidict\_multidict.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\lz4\_version.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_curve448.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_curve25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32\pythoncom311.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_asyncio.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_brotli.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_curve25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\multidict\_multidict.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\yarl\_quoting_c.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-file-l2-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32\pywintypes311.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\psutil\_psutil_windows.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-file-l1-2-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_brotli.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_curve448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_overlapped.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_uuid.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_ssl.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\psutil\_psutil_windows.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\python3.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_http_writer.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_ctypes.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\pywin32_system32\pywintypes311.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography\hazmat\bindings\_rust.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_http_writer.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_queue.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\python311.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\lz4\block\_block.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\propcache\_helpers_c.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\frozenlist\_frozenlist.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\_cffi_backend.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\lz4\_version.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_hashlib.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\_uuid.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-string-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68002\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\Desktop\Payload.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17224
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_12-18113
            Source: C:\Users\user\Desktop\Payload.exeAPI coverage: 4.2 %
            Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
            Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
            Source: C:\Users\user\Desktop\Payload.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B49280 FindFirstFileExW,FindClose,0_2_00007FF6D3B49280
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B483C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6D3B483C0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B61874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6D3B61874
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B49280 FindFirstFileExW,FindClose,1_2_00007FF6D3B49280
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B483C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,1_2_00007FF6D3B483C0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B61874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF6D3B61874
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B409280 FindFirstFileExW,FindClose,12_2_00007FF71B409280
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B4083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,12_2_00007FF71B4083C0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B421874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,12_2_00007FF71B421874
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA830180 GetSystemInfo,1_2_00007FFDFA830180
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vboxtray.exe
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware
            Source: Payload.exe, 0000000C.00000003.2065864267.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: System32\vmGuestLib.dll
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmwaretray.exe
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmusrvc.exe
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMwareTray.exe
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmtoolsd.exe
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMwareService.exe
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmwareuser
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: qemu-ga.exe
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: System32\vmGuestLib.dll-info
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vboxmrxnp.dll
            Source: Payload.exe, 0000000D.00000002.3686049757.000002A26D6BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmware_dll
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmsrvc.exe
            Source: Payload.exe, 00000001.00000003.1874334145.000001BB3156B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1871919658.000001BB31585000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3155D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875629440.000001BB31564000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873153314.000001BB31582000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllwwx
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vboxservice.exe
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B4D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6D3B4D12C
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B63480 GetProcessHeap,0_2_00007FF6D3B63480
            Source: C:\Users\user\Desktop\Payload.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B4D30C SetUnhandledExceptionFilter,0_2_00007FF6D3B4D30C
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B4D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6D3B4D12C
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B4C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6D3B4C8A0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B5A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6D3B5A614
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B4D30C SetUnhandledExceptionFilter,1_2_00007FF6D3B4D30C
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B4D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF6D3B4D12C
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B4C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FF6D3B4C8A0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FF6D3B5A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF6D3B5A614
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7D1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFA7D1960
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7D1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFA7D1390
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7E1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFA7E1960
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7E1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFA7E1390
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7F1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFA7F1960
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA7F1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFA7F1390
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA801960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFA801960
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA801390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFA801390
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA811960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFA811960
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA811390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFA811390
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA94CAF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFA94CAF0
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA992A90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFA992A90
            Source: C:\Users\user\Desktop\Payload.exeCode function: 1_2_00007FFDFA993058 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFA993058
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B40D30C SetUnhandledExceptionFilter,12_2_00007FF71B40D30C
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B40D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00007FF71B40D12C
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B40C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_00007FF71B40C8A0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeCode function: 12_2_00007FF71B41A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00007FF71B41A614
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Users\user\Desktop\Payload.exe "C:\Users\user\Desktop\Payload.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuidJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe" Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B69570 cpuid 0_2_00007FF6D3B69570
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Util VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Util VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\attrs-24.2.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\attrs-24.2.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\attrs-24.2.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\attrs-24.2.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\certifi VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\charset_normalizer VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info\license_files VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\lz4-4.3.3.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\lz4-4.3.3.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\lz4-4.3.3.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\lz4 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\ucrtbase.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\_ctypes.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-errorhandling-l1-1-0.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l1-1-0.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-util-l1-1-0.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\ucrtbase.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\VCRUNTIME140.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\yarl VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\_socket.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\select.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pyexpat.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\_queue.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32\pywintypes311.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64162\_asyncio.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeQueries volume information: C:\Users\user\Desktop\Payload.exe VolumeInformationJump to behavior
            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B4D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6D3B4D010
            Source: C:\Users\user\Desktop\Payload.exeCode function: 0_2_00007FF6D3B65C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF6D3B65C00
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: wireshark.exe
            Source: Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ollydbg.exe

            Stealing of Sensitive Information

            barindex
            Yara detected BLX Stealer
            Source: Yara matchFile source: 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.3690395576.000002A26F240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Payload.exe PID: 6612, type: MEMORYSTR
            Yara detected XLABB Grabber
            Source: Yara matchFile source: 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.3690395576.000002A26F240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Payload.exe PID: 6612, type: MEMORYSTR
            Tries to steal communication platform credentials (via file / registry access)
            Source: C:\Users\user\Desktop\Payload.exeFile opened: C:\Users\user\AppData\Local\DiscordJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeFile opened: C:\Users\user\AppData\Local\DiscordCanaryJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeFile opened: C:\Users\user\AppData\Local\DiscordPTBJump to behavior
            Source: C:\Users\user\Desktop\Payload.exeFile opened: C:\Users\user\AppData\Local\DiscordDevelopmentJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile opened: C:\Users\user\AppData\Local\DiscordJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile opened: C:\Users\user\AppData\Local\DiscordCanaryJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile opened: C:\Users\user\AppData\Local\DiscordPTBJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exeFile opened: C:\Users\user\AppData\Local\DiscordDevelopmentJump to behavior
            Yara detected Generic Python Stealer
            Source: Yara matchFile source: Process Memory Space: Payload.exe PID: 6612, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Payload.exe PID: 6612, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected BLX Stealer
            Source: Yara matchFile source: 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.3690395576.000002A26F240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Payload.exe PID: 6612, type: MEMORYSTR
            Yara detected XLABB Grabber
            Source: Yara matchFile source: 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.3690395576.000002A26F240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Payload.exe PID: 6612, type: MEMORYSTR
            Yara detected Generic Python Stealer
            Source: Yara matchFile source: Process Memory Space: Payload.exe PID: 6612, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts121
            Windows Management Instrumentation            		12
            Registry Run Keys / Startup Folder            		11
            Process Injection            		1
            Masquerading            		OS Credential Dumping2
            System Time Discovery            		Remote Services1
            Email Collection            		12
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts2
            Command and Scripting Interpreter            		1
            DLL Side-Loading            		12
            Registry Run Keys / Startup Folder            		12
            Virtualization/Sandbox Evasion            		LSASS Memory251
            Security Software Discovery            		Remote Desktop Protocol1
            Archive Collected Data            		1
            Non-Application Layer Protocol            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts1
            Native API            		Logon Script (Windows)1
            DLL Side-Loading            		11
            Process Injection            		Security Account Manager12
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared Drive2
            Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
            Deobfuscate/Decode Files or Information            		NTDS1
            Process Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Obfuscated Files or Information            		LSA Secrets1
            System Network Configuration Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Timestomp            		Cached Domain Credentials2
            File and Directory Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            DLL Side-Loading            		DCSync34
            System Information Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1555217 Sample: Payload.exe Startdate: 13/11/2024 Architecture: WINDOWS Score: 96 68 api.ipify.org 2->68 76 Antivirus / Scanner detection for submitted sample 2->76 78 Multi AV Scanner detection for submitted file 2->78 80 Yara detected XLABB Grabber 2->80 82 4 other signatures 2->82 9 Payload.exe 239 2->9         started        13 Payload.exe 239 2->13         started        signatures3 process4 file5 52 C:\Users\...\_quoting_c.cp311-win_amd64.pyd, PE32+ 9->52 dropped 54 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 9->54 dropped 56 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 9->56 dropped 64 168 other files (none is malicious) 9->64 dropped 84 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->84 86 Drops PE files to the startup folder 9->86 15 Payload.exe 5 9->15         started        58 C:\Users\...\_quoting_c.cp311-win_amd64.pyd, PE32+ 13->58 dropped 60 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 13->60 dropped 62 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 13->62 dropped 66 168 other files (none is malicious) 13->66 dropped 20 Payload.exe 13->20         started        signatures6 process7 dnsIp8 70 api.ipify.org 172.67.74.152, 443, 49731, 49739 CLOUDFLARENETUS United States 15->70 50 C:\Users\user\AppData\Roaming\...\Payload.exe, PE32+ 15->50 dropped 72 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 15->72 74 Tries to steal communication platform credentials (via file / registry access) 15->74 22 cmd.exe 1 15->22         started        24 cmd.exe 1 15->24         started        26 cmd.exe 15->26         started        28 cmd.exe 20->28         started        30 cmd.exe 20->30         started        32 cmd.exe 20->32         started        file9 signatures10 process11 process12 34 WMIC.exe 1 22->34         started        36 conhost.exe 22->36         started        38 conhost.exe 24->38         started        40 conhost.exe 26->40         started        42 conhost.exe 28->42         started        44 WMIC.exe 28->44         started        46 conhost.exe 30->46         started        48 conhost.exe 32->48         started       

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            Payload.exe58%ReversingLabsWin64.Trojan.PyngoStealerMarte
            Payload.exe100%AviraOSX/GM.ReverseShe.TH

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD4.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD5.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA1.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA224.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA256.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA384.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA512.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_keccak.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_poly1305.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Math\_modexp.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_curve25519.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_curve448.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Util\_strxor.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_ARC4.pyd0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://repository.swisssign.com/70%Avira URL Cloudsafe
            https://lz4.github.io/lz4/0%Avira URL Cloudsafe
            https://docs.aiohttp.org/en/stable/client_advanced.html#client-tracing0%Avira URL Cloudsafe
            https://superfurrycdn.nl/copy/0%Avira URL Cloudsafe
            https://requests.readthedocs.ioPpJo0%Avira URL Cloudsafe
            http://python-lz4.readthedocs.io/en/stable/0%Avira URL Cloudsafe
            https://bugs.py0%Avira URL Cloudsafe
            https://api.myip.comot-info0%Avira URL Cloudsafe
            https://127.0.0.1:84430%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            api.ipify.org
            		172.67.74.152
            		truefalse
              		high

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              https://discord.com/channels/Payload.exe, 0000000D.00000002.3694048579.000002A271310000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://github.com/pyca/cryptography/issues/8996Payload.exe, 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmpfalse
                  		high
                  https://github.com/giampaolo/psutil/issues/875.Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/python-attrs/attrs/issues/251Payload.exe, 00000001.00000002.3688335194.000001BB3268F000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://coinbase.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://i.scdn.co/image/Payload.exe, 00000001.00000002.3694241619.000001BB35250000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3694048579.000002A271310000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://discord.com/developers/applications/Payload.exe, 00000001.00000002.3694099874.000001BB35150000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/aio-libs/aiohttp/discussions/6044Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3693641952.000001BB34A80000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692167056.000001BB33B1A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://tiktok.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                http://docs.python.org/library/unittest.htmlPayload.exe, 00000001.00000002.3686554442.000001BB31B45000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2115108381.000002A26E74A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688294290.000002A26E721000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://python.orgPayload.exe, 00000001.00000002.3691864276.000001BB339B2000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    https://discord.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#Payload.exe, 00000001.00000002.3685675984.000001BB31330000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3684768211.000001BB2F5F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2091404363.000002A26B69D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2090283179.000002A26B6A0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3684401189.000002A26B639000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://cdn.discordapp.com/attachments/1207404349177724988/1247483882857828352/Picsart_24-06-04_12-3Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/sponsors/hynekPayload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://discord.com/api/vPayload.exe, 00000001.00000002.3694099874.000001BB35150000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              http://repository.swisssign.com/7Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://goo.gl/zeJZl.Payload.exe, 00000001.00000002.3691582161.000001BB336D0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.apache.org/licenses/LICENSE-2.0Payload.exe, 0000000C.00000003.2068444697.000001F0B2906000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2068171030.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2068171030.000001F0B2905000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64Payload.exe, 00000001.00000002.3685967283.000001BB31550000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://paypal.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/pypa/packagingPayload.exe, 00000001.00000002.3688041311.000001BB32390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687966279.000002A26E440000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.opensource.org/licenses/mit-license.phpPayload.exe, 0000000D.00000002.3691635284.000002A26FA72000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FDC1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://refspecs.linuxfoundation.org/elf/gabi4Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1877625811.000001BB31B45000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688156970.000001BB32490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1878743429.000001BB31B45000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2111006559.000002A26DC36000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://github.com/pypa/packaging62d2Payload.exe, 00000001.00000002.3688041311.000001BB32390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://xbox.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963Payload.exe, 00000001.00000002.3690747143.000001BB33090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://youtube.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/python-attrs/attrs/issues/136Payload.exe, 00000001.00000002.3689859176.000001BB32C71000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://tools.ietf.org/html/rfc3610Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692686032.000001BB33DF1000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://crl.dhimyotis.com/certignarootca.crlPayload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://curl.haxx.se/rfc/cookie_spec.htmlPayload.exe, 00000001.00000002.3691098089.000001BB33290000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3690859188.000002A26F340000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodePayload.exe, 00000001.00000002.3690747143.000001BB33090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://packages.debian.org/sid/iputils-arpingPayload.exe, 00000001.00000002.3691466187.000001BB33590000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3691343035.000001BB33490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691152828.000002A26F540000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691276421.000002A26F650000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://discord.com/oauth2/authorize?client_id=Payload.exe, 00000001.00000002.3693947132.000001BB35040000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://api.myip.comot-infoPayload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://superfurrycdn.nl/copy/Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenamePayload.exe, 00000001.00000002.3685123722.000001BB30EE0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3685355738.000002A26D070000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyPayload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://crunchyroll.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://github.com/python-attrs/attrs/issues/1330)Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://lz4.github.io/lz4/Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3Payload.exe, 00000001.00000002.3689993388.000001BB32D40000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689993388.000001BB32D40000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://wwww.certigna.fr/autorites/0mPayload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerPayload.exe, 00000001.00000002.3685675984.000001BB31330000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3684768211.000001BB2F5F8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2091404363.000002A26B69D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2090283179.000002A26B6A0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3684401189.000002A26B639000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/python/cpython/issues/86361.Payload.exe, 00000001.00000003.1871919658.000001BB3168E000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1872546038.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1877194604.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1870123075.000001BB316E4000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685967283.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873901840.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1875629440.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1888805316.000001BB3168D000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1870422272.000001BB31696000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1870785804.000001BB31696000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1870383769.000001BB316E4000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2093949784.000002A26D85F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://mail.python.org/pipermail/python-dev/2012-June/120787.html.Payload.exe, 00000001.00000002.3691466187.000001BB33590000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691276421.000002A26F650000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://ebay.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://httpbin.org/Payload.exe, 0000000D.00000002.3686049757.000002A26D708000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://www.apache.org/licenses/Payload.exe, 0000000C.00000003.2068171030.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=mainPayload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-filePayload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlPayload.exe, 00000001.00000003.1875114007.000001BB31A81000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873705923.000001BB31A2A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873705923.000001BB31A7D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_modulePayload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685553670.000001BB31130000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cachesPayload.exe, 00000001.00000002.3685123722.000001BB30EE0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3685355738.000002A26D070000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://filepreviews.io/Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://www.attrs.org/en/stable/why.html#data-classes)Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064985903.000001F0B2904000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000C.00000003.2064880770.000001F0B2904000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://discord.com/api/webhooks/Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3694556521.000001BB35450000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://playstation.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB326A8000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://cryptography.io/en/latest/installation/Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://sellix.io)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://brew.shPayload.exe, 00000001.00000002.3689547389.000001BB32C46000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://github.com/pypa/packaging02d2Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687966279.000002A26E440000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://github.com/pypa/setuptools/issues/417#issuecomment-392298401Payload.exe, 00000001.00000002.3686447175.000001BB31870000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://python-lz4.readthedocs.io/en/stable/Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		unknown
                                                                                                                                            https://wiki.debian.org/XDGBaseDirectorySpecification#statePayload.exe, 00000001.00000002.3685675984.000001BB31346000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://crl.securetrust.com/STCA.crlPayload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://ipinfo.io/Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://tools.ietf.org/html/rfc6125#section-6.4.3Payload.exe, 00000001.00000002.3691098089.000001BB33290000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3690859188.000002A26F340000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://www.attrs.org/en/stable/changelog.htmlPayload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://docs.aiohttp.org/en/stable/client_advanced.html#client-tracingPayload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3692342025.000001BB33BF0000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692682642.000002A26FDC1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://www.variomedia.de/Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://www.cert.fnmt.es/dpcs/Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://requests.readthedocs.ioPpJoPayload.exe, 0000000D.00000002.3691029912.000002A26F440000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                            		unknown
                                                                                                                                                            https://google.com/mailPayload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688335194.000001BB325D2000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3688190500.000002A26E640000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://github.com/jaraco/jaraco.functools/issues/5Payload.exe, 00000001.00000002.3688156970.000001BB32490000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687451811.000001BB31E90000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2103785691.000002A26DBDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://www.accv.es00Payload.exe, 00000001.00000002.3686554442.000001BB31990000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmPayload.exe, 00000001.00000003.1875114007.000001BB31A81000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873705923.000001BB31A2A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1873705923.000001BB31A7D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://www.rfc-editor.org/info/rfc7253Payload.exe, 00000001.00000002.3689170720.000001BB32A9B000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3692136441.000002A26FC14000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3686590415.000002A26DAB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://readthedocs.org/projects/python-lz4/Payload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://github.com/pyca/cryptography/issuesPayload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3691391157.000002A26F790000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3706057755.00007FFDF8BAA000.00000002.00000001.01000000.00000084.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://www.attrs.org/Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://github.com/lz4/lz4/blob/master/doc/lz4_Frame_format.mdPayload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://html4/loose.dtdPayload.exe, 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://mahler:8092/site-updates.pyPayload.exe, 00000001.00000002.3686554442.000001BB31D0D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://bugs.pyPayload.exe, 00000001.00000002.3692167056.000001BB33B1A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://cryptography.io/Payload.exe, 0000000C.00000003.2066762312.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).Payload.exe, 0000000C.00000003.2064880770.000001F0B28F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://127.0.0.1:8443Payload.exe, 00000001.00000002.3688825472.000001BB327A7000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3689993388.000001BB32D40000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3689661268.000002A26ED6E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        http://www.firmaprofesional.com/cps0Payload.exe, 00000001.00000002.3688335194.000001BB3268F000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688947634.000001BB329D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          http://opensource.org/licenses/BSD-3-ClausePayload.exe, 0000000C.00000003.2073629272.000001F0B28F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://docs.python.org/3/library/re.html#re.subPayload.exe, 00000001.00000003.1876464206.000001BB31BDE000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1882931783.000001BB31D4A000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3688041311.000001BB32390000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3687575023.000001BB31FA0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1876464206.000001BB31B76000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1882892267.000001BB32591000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687500255.000002A26E0B0000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000002.3687966279.000002A26E440000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_specPayload.exe, 00000001.00000003.1861583912.000001BB31339000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000003.1861700439.000001BB31331000.00000004.00000020.00020000.00000000.sdmp, Payload.exe, 00000001.00000002.3685553670.000001BB31130000.00000004.00001000.00020000.00000000.sdmp, Payload.exe, 0000000D.00000003.2087816823.000002A26D4BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://netflix.com)Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://github.com/urllib3/urllib3/issues/2920Payload.exe, 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high

                                                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                                                    Public IPs

                                                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                    172.67.74.152
                                                                                                                                                                                                    		api.ipify.orgUnited States
                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                    General Information

                                                                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                    Analysis ID:1555217
                                                                                                                                                                                                    Start date and time:2024-11-13 15:57:52 +01:00
                                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                                    Overall analysis duration:0h 12m 9s
                                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                                    Report type:full
                                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                    Run name:Run with higher sleep bypass
                                                                                                                                                                                                    Number of analysed new started processes analysed:22
                                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                                                                    Technologies:
                                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                                    Sample name:Payload.exe
                                                                                                                                                                                                    Detection:MAL
                                                                                                                                                                                                    Classification:mal96.troj.adwa.spyw.evad.winEXE@28/399@1/1
                                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                                    • Successful, ratio: 75%
                                                                                                                                                                                                    HCA Information:Failed
                                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                                    • Found application associated with file extension: .exe
                                                                                                                                                                                                    • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                                                                                                    • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                                                                                                                                                    Warnings

                                                                                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                    • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                    • VT rate limit hit for: Payload.exe

                                                                                                                                                                                                    Simulations

                                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                                    TimeTypeDescription
                                                                                                                                                                                                    14:59:10AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe

                                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                                    IPs

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    172.67.74.1522b7cu0KwZl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    Zc9eO57fgF.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    67065b4c84713_Javiles.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    Yc9hcFC1ux.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    4F08j2Rmd9.binGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    y8tCHz7CwC.binGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    file.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                                                                                    • api.ipify.org/

                                                                                                                                                                                                    Domains

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    api.ipify.orghttps://www.canva.com/design/DAGOCNo1NUI/fm7sxEzJIeZ3v2miLpNZCw/view?utm_content=DAGOCNo1NUI&utm_campaign=designshare&utm_medium=link&utm_source=editorGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.26.12.205
                                                                                                                                                                                                    setup7.0.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                    • 104.26.13.205
                                                                                                                                                                                                    DHL Delivery Invoice.com.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                    • 172.67.74.152
                                                                                                                                                                                                    fefbBqMKcU.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                    • 172.67.74.152
                                                                                                                                                                                                    yh5At5T1Zs.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                    • 104.26.12.205
                                                                                                                                                                                                    scan3762399_arleen@wcctxlaw.com.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 172.67.74.152
                                                                                                                                                                                                    x.exeGet hashmaliciousAgentTesla, DBatLoaderBrowse
                                                                                                                                                                                                    • 104.26.13.205
                                                                                                                                                                                                    neworigin.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                    • 104.26.12.205
                                                                                                                                                                                                    TC_Ziraat_Bankasi_Hesap_Ekstresi.cmdGet hashmaliciousAgentTesla, DBatLoaderBrowse
                                                                                                                                                                                                    • 104.26.13.205

                                                                                                                                                                                                    ASNs

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    CLOUDFLARENETUSaba5298f.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.18.86.42
                                                                                                                                                                                                    FW Cardenas Leslie shared Mathis IDS Remittance Copy with you.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.18.11.207
                                                                                                                                                                                                    https://www.dropbox.com.mcas-gov.ms/l/scl/AABSwu8KEz6sAXF6EDmPFvs56lPgSRwoxio?McasTsid=20893&McasCSRF=81f1afd142a81521476c396db0d440dc1f2327c03c65f90a0848092f4db6f69dGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 1.1.1.1
                                                                                                                                                                                                    https://www.calameo.com/read/007794614fc42ee64ee87Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.17.25.14
                                                                                                                                                                                                    http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.16.141.209
                                                                                                                                                                                                    https://wetransfer.com/downloads/dfae2da4024c0a427ba385707deb5ffa20240620022822/9659fcGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.26.1.90
                                                                                                                                                                                                    https://www.canva.com/design/DAGOCNo1NUI/fm7sxEzJIeZ3v2miLpNZCw/view?utm_content=DAGOCNo1NUI&utm_campaign=designshare&utm_medium=link&utm_source=editorGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.16.103.112
                                                                                                                                                                                                    Item-RQF-9456786.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                    file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                    • 104.21.0.123

                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_Salsa20.pydCreal.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                                                                      #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exeGet hashmaliciousBlank Grabber, Creal StealerBrowse
                                                                                                                                                                                                        https://t.ly/Oppenheim0511Get hashmaliciousGO BackdoorBrowse
                                                                                                                                                                                                          RobCheat.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                                                                                                                                                            SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              SecuriteInfo.com.Python.Stealer.1251.9496.6786.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                SecuriteInfo.com.Python.Stealer.1251.9496.6786.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                  SecuriteInfo.com.Win64.Malware-gen.32485.11504.exeGet hashmaliciousPython Stealer, BraodoBrowse
                                                                                                                                                                                                                    grA6aqodO5.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_ARC4.pydCreal.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                                                                                        #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exeGet hashmaliciousBlank Grabber, Creal StealerBrowse
                                                                                                                                                                                                                          https://t.ly/Oppenheim0511Get hashmaliciousGO BackdoorBrowse
                                                                                                                                                                                                                            RobCheat.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                                                                                                                                                                              SecuriteInfo.com.Python.Stealer.1251.9496.6786.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                                SecuriteInfo.com.Python.Stealer.1251.9496.6786.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                                  SecuriteInfo.com.Win64.Malware-gen.32485.11504.exeGet hashmaliciousPython Stealer, BraodoBrowse
                                                                                                                                                                                                                                    grA6aqodO5.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                                                                                                                                                                                      oconsole.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11264
                                                                                                                                                                                                                                        Entropy (8bit):4.640339306680604
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
                                                                                                                                                                                                                                        MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
                                                                                                                                                                                                                                        SHA1:EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
                                                                                                                                                                                                                                        SHA-256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
                                                                                                                                                                                                                                        SHA-512:8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                        • Filename: Creal.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: RobCheat.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: grA6aqodO5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: oconsole.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.0194545642425075
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
                                                                                                                                                                                                                                        MD5:F19CB847E567A31FAB97435536C7B783
                                                                                                                                                                                                                                        SHA1:4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
                                                                                                                                                                                                                                        SHA-256:1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
                                                                                                                                                                                                                                        SHA-512:382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                        • Filename: Creal.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: RobCheat.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: grA6aqodO5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.037456384995606
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
                                                                                                                                                                                                                                        MD5:DC14677EA8A8C933CC41F9CCF2BEDDC1
                                                                                                                                                                                                                                        SHA1:A6FB87E8F3540743097A467ABE0723247FDAF469
                                                                                                                                                                                                                                        SHA-256:68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
                                                                                                                                                                                                                                        SHA-512:3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.09191874780435
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
                                                                                                                                                                                                                                        MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
                                                                                                                                                                                                                                        SHA1:46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
                                                                                                                                                                                                                                        SHA-256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
                                                                                                                                                                                                                                        SHA-512:691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                        Entropy (8bit):6.541423493519083
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
                                                                                                                                                                                                                                        MD5:0AB25F99CDAACA6B11F2ECBE8223CAD5
                                                                                                                                                                                                                                        SHA1:7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
                                                                                                                                                                                                                                        SHA-256:6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
                                                                                                                                                                                                                                        SHA-512:11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.367749645917753
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
                                                                                                                                                                                                                                        MD5:B6EA675C3A35CD6400A7ECF2FB9530D1
                                                                                                                                                                                                                                        SHA1:0E41751AA48108D7924B0A70A86031DDE799D7D6
                                                                                                                                                                                                                                        SHA-256:76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
                                                                                                                                                                                                                                        SHA-512:E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):16384
                                                                                                                                                                                                                                        Entropy (8bit):5.41148259289073
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
                                                                                                                                                                                                                                        MD5:F14E1AA2590D621BE8C10321B2C43132
                                                                                                                                                                                                                                        SHA1:FD84D11619DFFDF82C563E45B48F82099D9E3130
                                                                                                                                                                                                                                        SHA-256:FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
                                                                                                                                                                                                                                        SHA-512:A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20992
                                                                                                                                                                                                                                        Entropy (8bit):6.041302713678401
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
                                                                                                                                                                                                                                        MD5:B127CAE435AEB8A2A37D2A1BC1C27282
                                                                                                                                                                                                                                        SHA1:2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
                                                                                                                                                                                                                                        SHA-256:538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
                                                                                                                                                                                                                                        SHA-512:4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):24576
                                                                                                                                                                                                                                        Entropy (8bit):6.530656045206549
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
                                                                                                                                                                                                                                        MD5:2E15AA6F97ED618A3236CFA920988142
                                                                                                                                                                                                                                        SHA1:A9D556D54519D3E91FA19A936ED291A33C0D1141
                                                                                                                                                                                                                                        SHA-256:516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
                                                                                                                                                                                                                                        SHA-512:A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.7080156150187396
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
                                                                                                                                                                                                                                        MD5:40390F2113DC2A9D6CFAE7127F6BA329
                                                                                                                                                                                                                                        SHA1:9C886C33A20B3F76B37AA9B10A6954F3C8981772
                                                                                                                                                                                                                                        SHA-256:6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
                                                                                                                                                                                                                                        SHA-512:617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):5.159963979391524
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
                                                                                                                                                                                                                                        MD5:899895C0ED6830C4C9A3328CC7DF95B6
                                                                                                                                                                                                                                        SHA1:C02F14EBDA8B631195068266BA20E03210ABEABC
                                                                                                                                                                                                                                        SHA-256:18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
                                                                                                                                                                                                                                        SHA-512:0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.270418334522813
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
                                                                                                                                                                                                                                        MD5:C4C525B081F8A0927091178F5F2EE103
                                                                                                                                                                                                                                        SHA1:A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
                                                                                                                                                                                                                                        SHA-256:4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
                                                                                                                                                                                                                                        SHA-512:7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):56832
                                                                                                                                                                                                                                        Entropy (8bit):4.231032526864278
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
                                                                                                                                                                                                                                        MD5:F9E266F763175B8F6FD4154275F8E2F0
                                                                                                                                                                                                                                        SHA1:8BE457700D58356BC2FA7390940611709A0E5473
                                                                                                                                                                                                                                        SHA-256:14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
                                                                                                                                                                                                                                        SHA-512:EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):57344
                                                                                                                                                                                                                                        Entropy (8bit):4.252429732285762
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
                                                                                                                                                                                                                                        MD5:DECF524B2D53FCD7D4FA726F00B3E5FC
                                                                                                                                                                                                                                        SHA1:E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
                                                                                                                                                                                                                                        SHA-256:58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
                                                                                                                                                                                                                                        SHA-512:EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.690163963718492
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
                                                                                                                                                                                                                                        MD5:80BB1E0E06ACAF03A0B1D4EF30D14BE7
                                                                                                                                                                                                                                        SHA1:B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
                                                                                                                                                                                                                                        SHA-256:5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
                                                                                                                                                                                                                                        SHA-512:2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):6.1215844022564285
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
                                                                                                                                                                                                                                        MD5:3727271FE04ECB6D5E49E936095E95BC
                                                                                                                                                                                                                                        SHA1:46182698689A849A8C210A8BF571D5F574C6F5B1
                                                                                                                                                                                                                                        SHA-256:3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
                                                                                                                                                                                                                                        SHA-512:5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.293810509074883
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
                                                                                                                                                                                                                                        MD5:78AEF441C9152A17DD4DC40C7CC9DF69
                                                                                                                                                                                                                                        SHA1:6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
                                                                                                                                                                                                                                        SHA-256:56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
                                                                                                                                                                                                                                        SHA-512:27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11776
                                                                                                                                                                                                                                        Entropy (8bit):4.862619033406922
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
                                                                                                                                                                                                                                        MD5:19E0ABF76B274C12FF624A16713F4999
                                                                                                                                                                                                                                        SHA1:A4B370F556B925F7126BF87F70263D1705C3A0DB
                                                                                                                                                                                                                                        SHA-256:D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
                                                                                                                                                                                                                                        SHA-512:D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.227045547076371
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
                                                                                                                                                                                                                                        MD5:309D6F6B0DD022EBD9214F445CAC7BB9
                                                                                                                                                                                                                                        SHA1:ABD22690B7AD77782CFC0D2393D0C038E16070B0
                                                                                                                                                                                                                                        SHA-256:4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
                                                                                                                                                                                                                                        SHA-512:D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.176369829782773
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
                                                                                                                                                                                                                                        MD5:D54FEB9A270B212B0CCB1937C660678A
                                                                                                                                                                                                                                        SHA1:224259E5B684C7AC8D79464E51503D302390C5C9
                                                                                                                                                                                                                                        SHA-256:032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
                                                                                                                                                                                                                                        SHA-512:29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.047563322651927
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
                                                                                                                                                                                                                                        MD5:52DCD4151A9177CF685BE4DF48EA9606
                                                                                                                                                                                                                                        SHA1:F444A4A5CBAE9422B408420115F0D3FF973C9705
                                                                                                                                                                                                                                        SHA-256:D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
                                                                                                                                                                                                                                        SHA-512:64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.09893680790018
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
                                                                                                                                                                                                                                        MD5:F929B1A3997427191E07CF52AC883054
                                                                                                                                                                                                                                        SHA1:C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
                                                                                                                                                                                                                                        SHA-256:5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
                                                                                                                                                                                                                                        SHA-512:2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.451865349855574
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
                                                                                                                                                                                                                                        MD5:1FA5E257A85D16E916E9C22984412871
                                                                                                                                                                                                                                        SHA1:1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
                                                                                                                                                                                                                                        SHA-256:D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
                                                                                                                                                                                                                                        SHA-512:E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.104245335186531
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
                                                                                                                                                                                                                                        MD5:FAD578A026F280C1AE6F787B1FA30129
                                                                                                                                                                                                                                        SHA1:9A3E93818A104314E172A304C3D117B6A66BEB55
                                                                                                                                                                                                                                        SHA-256:74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
                                                                                                                                                                                                                                        SHA-512:ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.671305741258107
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
                                                                                                                                                                                                                                        MD5:556E6D0E5F8E4DA74C2780481105D543
                                                                                                                                                                                                                                        SHA1:7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
                                                                                                                                                                                                                                        SHA-256:247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
                                                                                                                                                                                                                                        SHA-512:28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....*..........P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                        Entropy (8bit):5.878701941774916
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
                                                                                                                                                                                                                                        MD5:2F2655A7BBFE08D43013EDDA27E77904
                                                                                                                                                                                                                                        SHA1:33D51B6C423E094BE3E34E5621E175329A0C0914
                                                                                                                                                                                                                                        SHA-256:C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
                                                                                                                                                                                                                                        SHA-512:8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                        Entropy (8bit):5.881781476285865
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
                                                                                                                                                                                                                                        MD5:CDE035B8AB3D046B1CE37EEE7EE91FA0
                                                                                                                                                                                                                                        SHA1:4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
                                                                                                                                                                                                                                        SHA-256:16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
                                                                                                                                                                                                                                        SHA-512:C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                        Entropy (8bit):5.837887867708438
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
                                                                                                                                                                                                                                        MD5:999D431197D7E06A30E0810F1F910B9A
                                                                                                                                                                                                                                        SHA1:9BFF781221BCFFD8E55485A08627EC2A37363C96
                                                                                                                                                                                                                                        SHA-256:AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
                                                                                                                                                                                                                                        SHA-512:A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                        Entropy (8bit):5.895310340516013
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
                                                                                                                                                                                                                                        MD5:0931ABBF3AED459B1A2138B551B1D3BB
                                                                                                                                                                                                                                        SHA1:9EC0296DDAF574A89766A2EC035FC30073863AB0
                                                                                                                                                                                                                                        SHA-256:1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
                                                                                                                                                                                                                                        SHA-512:9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):4.967737129255606
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
                                                                                                                                                                                                                                        MD5:5F057A380BACBA4EF59C0611549C0E02
                                                                                                                                                                                                                                        SHA1:4B758D18372D71F0AA38075F073722A55B897F71
                                                                                                                                                                                                                                        SHA-256:BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
                                                                                                                                                                                                                                        SHA-512:E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.007867576025166
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
                                                                                                                                                                                                                                        MD5:49BCA1B7DF076D1A550EE1B7ED3BD997
                                                                                                                                                                                                                                        SHA1:47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
                                                                                                                                                                                                                                        SHA-256:49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
                                                                                                                                                                                                                                        SHA-512:8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15872
                                                                                                                                                                                                                                        Entropy (8bit):5.226023387740053
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
                                                                                                                                                                                                                                        MD5:CB5CFDD4241060E99118DEEC6C931CCC
                                                                                                                                                                                                                                        SHA1:1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
                                                                                                                                                                                                                                        SHA-256:A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
                                                                                                                                                                                                                                        SHA-512:8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.262055670423592
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
                                                                                                                                                                                                                                        MD5:18D2D96980802189B23893820714DA90
                                                                                                                                                                                                                                        SHA1:5DEE494D25EB79038CBC2803163E2EF69E68274C
                                                                                                                                                                                                                                        SHA-256:C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
                                                                                                                                                                                                                                        SHA-512:0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                        Entropy (8bit):5.913843738203007
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
                                                                                                                                                                                                                                        MD5:EF472BA63FD22922CA704B1E7B95A29E
                                                                                                                                                                                                                                        SHA1:700B68E7EF95514D5E94D3C6B10884E1E187ACD8
                                                                                                                                                                                                                                        SHA-256:66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
                                                                                                                                                                                                                                        SHA-512:DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.735350805948923
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
                                                                                                                                                                                                                                        MD5:3B1CE70B0193B02C437678F13A335932
                                                                                                                                                                                                                                        SHA1:063BFD5A32441ED883409AAD17285CE405977D1F
                                                                                                                                                                                                                                        SHA-256:EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
                                                                                                                                                                                                                                        SHA-512:0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_curve25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22528
                                                                                                                                                                                                                                        Entropy (8bit):5.705606408072877
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
                                                                                                                                                                                                                                        MD5:FF33C306434DEC51D39C7BF1663E25DA
                                                                                                                                                                                                                                        SHA1:665FCF47501F1481534597C1EAC2A52886EF0526
                                                                                                                                                                                                                                        SHA-256:D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
                                                                                                                                                                                                                                        SHA-512:66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_curve448.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):70656
                                                                                                                                                                                                                                        Entropy (8bit):6.0189903352673655
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
                                                                                                                                                                                                                                        MD5:F267BF4256F4105DAD0D3E59023011ED
                                                                                                                                                                                                                                        SHA1:9BC6CA0F375CE49D5787C909D290C07302F58DA6
                                                                                                                                                                                                                                        SHA-256:1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
                                                                                                                                                                                                                                        SHA-512:A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):770560
                                                                                                                                                                                                                                        Entropy (8bit):7.613224993327352
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
                                                                                                                                                                                                                                        MD5:1EFD7F7CB1C277416011DE6F09C355AF
                                                                                                                                                                                                                                        SHA1:C0F97652AC2703C325AB9F20826A6F84C63532F2
                                                                                                                                                                                                                                        SHA-256:AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
                                                                                                                                                                                                                                        SHA-512:2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26112
                                                                                                                                                                                                                                        Entropy (8bit):5.8551858881598795
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
                                                                                                                                                                                                                                        MD5:C5FB377F736ED731B5578F57BB765F7A
                                                                                                                                                                                                                                        SHA1:5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
                                                                                                                                                                                                                                        SHA-256:32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
                                                                                                                                                                                                                                        SHA-512:D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):84992
                                                                                                                                                                                                                                        Entropy (8bit):6.064677498000638
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
                                                                                                                                                                                                                                        MD5:8A0C0AA820E98E83AC9B665A9FD19EAF
                                                                                                                                                                                                                                        SHA1:6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
                                                                                                                                                                                                                                        SHA-256:4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
                                                                                                                                                                                                                                        SHA-512:52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.675380950473425
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
                                                                                                                                                                                                                                        MD5:44B930B89CE905DB4716A548C3DB8DEE
                                                                                                                                                                                                                                        SHA1:948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
                                                                                                                                                                                                                                        SHA-256:921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
                                                                                                                                                                                                                                        SHA-512:79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.625428549874022
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
                                                                                                                                                                                                                                        MD5:F24F9356A6BDD29B9EF67509A8BC3A96
                                                                                                                                                                                                                                        SHA1:A26946E938304B4E993872C6721EB8CC1DCBE43B
                                                                                                                                                                                                                                        SHA-256:034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
                                                                                                                                                                                                                                        SHA-512:C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11264
                                                                                                                                                                                                                                        Entropy (8bit):4.704418348721006
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:nDzsc9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDj90OcX6gY/7ECFV:Dzs69damqTrpYTst0E5DjPcqgY/79X
                                                                                                                                                                                                                                        MD5:85F144F57905F68ECBF14552BAB2F070
                                                                                                                                                                                                                                        SHA1:83A20193E6229EA09DCCAE8890A74DBDD0A76373
                                                                                                                                                                                                                                        SHA-256:28696C8881D9C9272DE4E54ABE6760CD4C6CB22AD7E3FEABAF6FF313EC9A9EAF
                                                                                                                                                                                                                                        SHA-512:533EB4073594BFE97850DFF7353439BACD4E19539E247EE00D599F3468E162D2D88C5CA32322772538A73706DF9A6DD14553B35F47C686D2E20D915FAB766BDA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...O..e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):4.968532257508093
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:JF3rugNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDq4wYH/kcX6G:tF/1nb2mhQtkXHTeZ87VDqyMcqgYvEp
                                                                                                                                                                                                                                        MD5:14A20ED2868F5B3D7DCFEF9363CB1F32
                                                                                                                                                                                                                                        SHA1:C1F2EF94439F42AA39DCDE1075DEFAC8A6029DC6
                                                                                                                                                                                                                                        SHA-256:A072631CD1757D5147B5E403D6A96EF94217568D1DC1AE5C67A1892FBF61409E
                                                                                                                                                                                                                                        SHA-512:33BE8B3733380C3ADFE5D2844819C754FB11FCBC7AA75DA8FBB4D6CEF938E7D3267FBD215B9666DCFA5795D54484360A61DAF193BC75B57C252D44E5F9F0D855
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.061520684813544
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:cdF/1nb2mhQtkXn0t/WS60YYDEbqvdvGyv9lkVcqgYvEMo:e2f6XSZ6XYD5vdvGyv9MgYvEMo
                                                                                                                                                                                                                                        MD5:E2AB7EECFD020CFDEBA6DD3ADD732EB7
                                                                                                                                                                                                                                        SHA1:26975087F7AC8001830CAD4151003DBCABF82126
                                                                                                                                                                                                                                        SHA-256:85BCF0FD811ADE1396E3A93EEEF6BC6B88D5555498BA09C164FAA3092DACDEFF
                                                                                                                                                                                                                                        SHA-512:EB45126A07128E0FA8DC2B687F833BA95BB8703D7BC06E5C34F828EAEF062CFCA56D8A51A73B20DFA771595F6C6D830B659B5C0EB62467C61E95C97C4A73398D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.236611028290556
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:osiHXqpoUol3xZhRyQX5lDnRDFFav+tcqgRvE:K6D+XBDfDgRvE
                                                                                                                                                                                                                                        MD5:7FA5B1642D52FABFE1D3EBD1080056D4
                                                                                                                                                                                                                                        SHA1:56B9E87D613EE9A8B6B71A93ED5FA1603886139A
                                                                                                                                                                                                                                        SHA-256:88C7EC96B9E1D168005B3A8727AAA7F76B4B2985083ED7A9FB0A2AB02446E963
                                                                                                                                                                                                                                        SHA-512:9E0BF47060A2B7AC8FFD2CB8B845D44013C068BFE74926A67496D79BCB513506625BDA1DDF18ECE7777D1379F036506F19457D0A43FA618A8F75664C47798E64
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..*...*...*...R...*...U...*..R...*...*...*...U...*...U...*...U...*.....*.....*...}..*.....*..Rich.*..........................PE..d...N..e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                        Entropy (8bit):6.558039926510444
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:Dz5P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuTLg46:DzdqWB7YJlmLJ3oD/S4j990th9VTsC
                                                                                                                                                                                                                                        MD5:E63FC8375E1D8C47FBB84733F38A9552
                                                                                                                                                                                                                                        SHA1:995C32515AA183DA58F970CEDC6667FAE166615A
                                                                                                                                                                                                                                        SHA-256:F47F9C559A9C642DA443896B5CD24DE74FED713BDF6A9CD0D20F5217E4124540
                                                                                                                                                                                                                                        SHA-512:4213189F619E7AA71934033CABA401FE93801B334BA8D8EAFEDA89F19B13224C516E4BB4F4F93F6AE2C21CD8F5586D3FFAC3D16CB1242183B9302A1F408F6F6A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...L..e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15872
                                                                                                                                                                                                                                        Entropy (8bit):5.285246086368036
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:jJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4mqccqgwYUMvEW:ZkRwi3wO26Ef+yuIm9PfDewgwYUMvE
                                                                                                                                                                                                                                        MD5:A914F3D22DA22F099CB0FBFBBB75DDBF
                                                                                                                                                                                                                                        SHA1:2834AEB657CA301D722D6D4D1672239C83BE97E3
                                                                                                                                                                                                                                        SHA-256:4B4DBF841EC939EF9CC4B4F1B1BA436941A3F2AF2F4E34F82C568DFC09BA0358
                                                                                                                                                                                                                                        SHA-512:15BF5FCE53FB2C524054D02C2E48E3DDC4EAC0C1F73325D58B04DFE17259C208FFAC0A7C634FBC2CF1A08E7F28C1FD456061BA0838F4316EB37514E1E8D4C95F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d...L..e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):16384
                                                                                                                                                                                                                                        Entropy (8bit):5.505232918566824
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:9d9VkyQ5f8vjVaCHpKpTTjaNe7oca2DWZQ2dhmdcqgwNeecBih:rkP5cjIGpKlqD2DakzgwNeE
                                                                                                                                                                                                                                        MD5:9F1A2A9D731E7755EE93C82C91FA5FE2
                                                                                                                                                                                                                                        SHA1:41085FBE84E1B98A795871033034FA1F186274EF
                                                                                                                                                                                                                                        SHA-256:17F3EAF463868B015583BD611BE5251E36AAB616522FF4072011B3D72F6F552F
                                                                                                                                                                                                                                        SHA-512:7E29D4729837D87AEF34CFA7B1F86DFBB81907CD11FC575C4ED1B8A956409492315BFA76ADE4D7C51E51E37E5D098A7F4FEE4C58D86D0E6245A4AA0D392D488A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20992
                                                                                                                                                                                                                                        Entropy (8bit):6.061115794354147
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:pUv5cJMOZA0nmwBD+XpJgLa0Mp8QHg4P2llyM:GK1XBD+DgLa1gTi
                                                                                                                                                                                                                                        MD5:883DE82B3B17F95735F579E78A19D509
                                                                                                                                                                                                                                        SHA1:3EC7259ACA3730B2A6F4E1CA5121DB4AB41C619E
                                                                                                                                                                                                                                        SHA-256:67FF6C8BBDC9E33B027D53A26DF39BA2A2AD630ACCE1BAC0B0583CA31ADF914F
                                                                                                                                                                                                                                        SHA-512:602915EAA0933F5D1A26ECC1C32A8367D329B12794CBF2E435B1704E548858E64710AB52BC6FC14FC98DF0B8EEBDE2B32A35BCF935079CC8E2412C07DF5303FD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):25088
                                                                                                                                                                                                                                        Entropy (8bit):6.475398255636883
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:Zc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy7IYgLWi:q6H1TZXX5XmrXA+NNxWi0dLWi
                                                                                                                                                                                                                                        MD5:0AC22DA9F0B2F84DE9D2B50D457020C1
                                                                                                                                                                                                                                        SHA1:682E316AE958121D0E704CAB0F78CCAD42C77573
                                                                                                                                                                                                                                        SHA-256:480C79C713AD15328E9EB9F064B90BCDCB5AAD149236679F97B61218F6D2D200
                                                                                                                                                                                                                                        SHA-512:11C04D55C5E73583D658E0918BD5A37C7585837A6E0F3C78AEF10A5D7A5C848B0620028177A9D9B0AD5DB882B2A26624F92BEFC9BC8F8A23C002723E50DD80A5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.839420412830416
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:CF/1nb2mhQtkr+juOxKbDbRHcqgYvEkrK:42f6iuOsbDXgYvEmK
                                                                                                                                                                                                                                        MD5:6840F030DF557B08363C3E96F5DF3387
                                                                                                                                                                                                                                        SHA1:793A8BA0A7BDB5B7E510FC9A9DDE62B795F369AE
                                                                                                                                                                                                                                        SHA-256:B7160ED222D56925E5B2E247F0070D5D997701E8E239EC7F80BCE21D14FA5816
                                                                                                                                                                                                                                        SHA-512:EDF5A4D5A3BFB82CC140CE6CE6E9DF3C8ED495603DCF9C0D754F92F265F2DCE6A83F244E0087309B42930D040BF55E66F34504DC1C482A274AD8262AA37D1467
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...N..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):4.905258571193623
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:fRgPX8lvI+KnwSDTPUDEnKWPXcqgzQkvEd:4og9rUD/mpgzQkvE
                                                                                                                                                                                                                                        MD5:7256877DD2B76D8C6D6910808222ACD8
                                                                                                                                                                                                                                        SHA1:C6468DB06C4243CE398BEB83422858B3FED76E99
                                                                                                                                                                                                                                        SHA-256:DBF703293CFF0446DFD15BBAEDA52FB044F56A353DDA3BECA9AADD8A959C5798
                                                                                                                                                                                                                                        SHA-512:A14D460D96845984F052A8509E8FC44439B616EEAE46486DF20F21CCAA8CFB1E55F1E4FA2F11A7B6AB0A481DE62636CEF19EB5BEF2591FE83D415D67EB605B8E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...N..e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.300728193650235
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:jGYJ1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDr6krRcqgUF6+6vEX:jR01si8XSi3SACqe7tDlDgUUjvE
                                                                                                                                                                                                                                        MD5:B063D73E5AA501060C303CAFBC72DAD3
                                                                                                                                                                                                                                        SHA1:8C1CA04A8ED34252EB233C993DDBA17803E0B81E
                                                                                                                                                                                                                                        SHA-256:98BACA99834DE65FC29EFA930CD9DBA8DA233B4CFDFC4AB792E1871649B2FE5C
                                                                                                                                                                                                                                        SHA-512:8C9AD249F624BDF52A3C789C32532A51D3CC355646BD725553A738C4491EA483857032FB20C71FD3698D7F68294E3C35816421DFF263D284019A9A4774C3AF05
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..*B..*B..*B..R...*B..UC..*B.RC..*B..*C..*B..UG..*B..UF..*B..UA..*B..J..*B..B..*B....*B..@..*B.Rich.*B.........................PE..d...O..e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):57856
                                                                                                                                                                                                                                        Entropy (8bit):4.260136375669177
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:9RUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZvZY0JAIg+v:9rHGHfJidIK
                                                                                                                                                                                                                                        MD5:3AEA5302F7F03EDEFF49D1C119C61693
                                                                                                                                                                                                                                        SHA1:DBDDE1C10B253744153FC1F47C078AAACCF3F3A6
                                                                                                                                                                                                                                        SHA-256:E5DDA67D4DF47B7F00FF17BE6541CA80BDB4B60E1F6FD1A7D7F115DDF7683EE5
                                                                                                                                                                                                                                        SHA-512:DD42C24EDAF7E1B25A51BC8C96447496B3289C612C395CA7BD8BF60A162229C2E0CA0432CDDF1CB2D65D80189DB02BEE42FFD0E7DD9E5FC19278CA3FD593AB2C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...M..e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):58368
                                                                                                                                                                                                                                        Entropy (8bit):4.276947153784193
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:98Uqho9weF5/eHkRnYcZiGKdZHDL7idErZ8ZYXGg:9gCneH//idv2
                                                                                                                                                                                                                                        MD5:BA5BA714AEBFD8130EB6E0983FBAE20B
                                                                                                                                                                                                                                        SHA1:3309C26A9083EC3AD982DD3D6630FCC16465F251
                                                                                                                                                                                                                                        SHA-256:861167DFEB390261E538D635EAD213E81C1166D8D85A496774FBF2EBFF5A4332
                                                                                                                                                                                                                                        SHA-512:309CC3FD8DB62517AE70B404C5ACD01052F10582A17123135CD1A28D3A74AB28F90A8E7ED7D2061A4B6C082F85E98DA822D43986FC99367B288A72BA9F8B5569
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...N..e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.579354442149926
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:j0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwoYPj15XkcX6gbW6z:pVddiT7pgTctEEI4qXDe11kcqgbW6
                                                                                                                                                                                                                                        MD5:1C74E15EC55BD8767968024D76705EFC
                                                                                                                                                                                                                                        SHA1:C590D1384D2207B3AF01A46A5B4F7A2AE6BCAD93
                                                                                                                                                                                                                                        SHA-256:0E3EC56A1F3C86BE1CAA503E5B89567AA91FD3D6DA5AD4E4DE4098F21270D86B
                                                                                                                                                                                                                                        SHA-512:E96CA56490FCE7E169CC0AB803975BAA8B5ACB8BBAB5047755AE2EEAE177CD4B852C0620CD77BCFBC81AD18BB749DEC65D243D1925288B628F155E8FACDC3540
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):6.143744403797058
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:7Uv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Qy0gYP2lXCM:UKR8I+K0lDFQgLa1WzU
                                                                                                                                                                                                                                        MD5:E7826C066423284539BD1F1E99BA0CC6
                                                                                                                                                                                                                                        SHA1:DA7372EEB180C2E9A6662514A8FA6261E04AC6DC
                                                                                                                                                                                                                                        SHA-256:0E18B7C2686BB954A8EE310DD5FDB76D00AC078A12D883028BFFC336E8606DA2
                                                                                                                                                                                                                                        SHA-512:55F8B00B54F3C3E80803D5A3611D5301E29A2C6AF6E2CAA36249AEBA1D4FCC5A068875B34D65106C137F0455F11B20226B48EEF687F5EA73DFEA3C852BF07050
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.353670931504009
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:tPHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8Ng6Vf4A:DPcnB8KSsB34cb+bcOYpMCBDB
                                                                                                                                                                                                                                        MD5:D5DB7192A65D096433F5F3608E5AD922
                                                                                                                                                                                                                                        SHA1:22AD6B635226C8F6B94F85E4FBFB6F8C18B613C8
                                                                                                                                                                                                                                        SHA-256:FAB286E26160820167D427A4AAB14BE4C23883C543E2B0C353F931C89CEA3638
                                                                                                                                                                                                                                        SHA-512:5503E83D68D144A6D182DCC5E8401DD81C1C98B04B5ED24223C77D94B0D4F2DD1DD05AED94B9D619D30D2FE73DFFA6E710664FFC71B8FA53E735F968B718B1D9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...O..e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.741875402338703
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:sCF/1nb2mhQtkgU7L9D0E7tfcqgYvEJPb:N2f6L9D5JxgYvEJj
                                                                                                                                                                                                                                        MD5:134F891DE4188C2428A2081E10E675F0
                                                                                                                                                                                                                                        SHA1:22CB9B0FA0D1028851B8D28DAFD988D25E94D2FD
                                                                                                                                                                                                                                        SHA-256:F326AA2A582B773F4DF796035EC9BF69EC1AD11897C7D0ECFAB970D33310D6BA
                                                                                                                                                                                                                                        SHA-512:43CE8AF33630FD907018C62F100BE502565BAD712AD452A327AE166BD305735799877E14BE7A46D243D834F3F884ABF6286088E30533050ED9CD05D23AACAEAB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...O..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.213290591994899
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:oF/1nb2mhQtkRySMfJ2ycxFzShJD9dAal2QDeJKcqgQx2QY:C2fKRQB2j8JD4fJagQx2QY
                                                                                                                                                                                                                                        MD5:7D6979D69CD34652D5A3A197300AB65C
                                                                                                                                                                                                                                        SHA1:E9C7EF62B7042B3BAC75B002851C41EFEEE343CE
                                                                                                                                                                                                                                        SHA-256:2365B7C2AF8BBAC3844B7BEF47D5C49C234A159234A153515EB0634EEC0557CC
                                                                                                                                                                                                                                        SHA-512:CBDBE0DF4F6CB6796D54969B0EEF06C0CDA86FF34A2B127BF0272C819FB224D6E5393D5C9B31E53A24EAC9A3A1AEA6E0854A8D7911CF7C4C99292C931B8B05DF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.181893965844124
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:cF/1nb2mhQt7fSOp/CJPvADQoKtxSOvbcqgEvcM+:22fNKOZWPIDMxVlgEvL
                                                                                                                                                                                                                                        MD5:C3BA97B2D8FFFDB05F514807C48CABB2
                                                                                                                                                                                                                                        SHA1:7BC7FBDE6A372E5813491BBD538FD49C0A1B7C26
                                                                                                                                                                                                                                        SHA-256:4F78E61B376151CA2D0856D2E59976670F5145FBABAB1EEC9B2A3B5BEBB4EEF6
                                                                                                                                                                                                                                        SHA-512:57C1A62D956D8C6834B7BA81C2D125A40BF466E833922AE3759CF2C1017F8CAF29F4502A5A0BCBC95D74639D86BAF20F0335A45F961CFCAC39B4ED81E318F4EB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_MD2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.1399121410532445
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:HsiHXqpo0cUp8XnUp8XjEQnlDtTI6rcqgcx2:J6DcUp8XUp8AclDy69gcx2
                                                                                                                                                                                                                                        MD5:BB4CF5E97D4031B47CC7B7DAEDA005DD
                                                                                                                                                                                                                                        SHA1:4F596DCE9A8546AE22BA8851B22FCE62C2C69973
                                                                                                                                                                                                                                        SHA-256:325512FF7E0261AF1DA4760C5A8BB8BA7BA8C532F0068D770621CD2CC89E04C6
                                                                                                                                                                                                                                        SHA-512:93088745BA922918A8EBC20C7043DA4C3C639245547BE665D15625B7F808EC0BF120841ACEEFCE71134921EF8379821769DE35D32CCCC55E6B391C57C7F4D971
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...A..e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_MD4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.204576067987685
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:JsiHXqpwUiv6wPf+4WVrd1DFrXqwWwcqgfvE:36biio2Pd1DFrlgfvE
                                                                                                                                                                                                                                        MD5:D2131380B7760D5BC3C2E1772C747830
                                                                                                                                                                                                                                        SHA1:DA5838E1C6DF5EC45AC0963E98761E9188A064D0
                                                                                                                                                                                                                                        SHA-256:6DB786B30F6682CD699E22D0B06B873071DCC569557B6EB6EC1416689C0890FE
                                                                                                                                                                                                                                        SHA-512:594939FB1D9154E15106D4B4AA9EF51A6AE5062D471ED7C0779A8E3D84D8F4B1481529015E0926A3489119DA37BE6CFE70C70ED695A6E84F6AF8F65402F6AAB5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_MD5.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.4787123381499825
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:3Z9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZuRsP0rcqgjPrvE:SQ0gH7zSccA5J6ECTGmDMa89gjPrvE
                                                                                                                                                                                                                                        MD5:CAF687A7786892939FFF5D5B6730E069
                                                                                                                                                                                                                                        SHA1:96C2567A770E12C15903767A85ABF8AF57FE6D6A
                                                                                                                                                                                                                                        SHA-256:9001E0C50D77823D64C1891F12E02E77866B9EDE783CEF52ED4D01A32204781B
                                                                                                                                                                                                                                        SHA-512:0B3C9E5C1F7EF52E615D9E1E6F7D91324BAB7C97FFAFB6DBAEB229CF1B86420A3534493C34DD9FAEB4BBC3612F245248ABA34393311C31500D827538DFE24BC5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):18432
                                                                                                                                                                                                                                        Entropy (8bit):5.69653684522693
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:pkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+D0ngkov:2nx7RI26LuuHKz8+D5N
                                                                                                                                                                                                                                        MD5:9762DBF0527A46F21852CA5303E245C3
                                                                                                                                                                                                                                        SHA1:33333912F16BB755B0631D8308D94DA2D7589127
                                                                                                                                                                                                                                        SHA-256:0DF91D69B8D585D2660168125E407E3CB3D87F338B3628E5E0C2BF49C9D20DB8
                                                                                                                                                                                                                                        SHA-512:52687C38939710C90A8C97F2C465AF8CF0309E3939255427B88BC461E27FADA79B0CB31F8BD215F72B610CAC093934C066141B9298353F04CC067C4E68B31DF0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%.*... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA1.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):19456
                                                                                                                                                                                                                                        Entropy (8bit):5.798411671336839
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:cPHNP3MjevhSY/8EBbVxcJ0ihTLdFDUPHgj+kf4D:mPcKvr/jUJ0sbDoAj+t
                                                                                                                                                                                                                                        MD5:74DAAAB71F93BCE184D507A45A88985C
                                                                                                                                                                                                                                        SHA1:3D09D69E94548EC6975177B482B68F86EDA32BB8
                                                                                                                                                                                                                                        SHA-256:E781D6DAF2BAAA2C1A45BD1CDDB21BA491442D49A03255C1E367F246F17E13BF
                                                                                                                                                                                                                                        SHA-512:870EC2752304F12F2F91BE688A34812AC1C75D444A0107284E3C45987639D8D07116EB98DB76931F9C8487666E1B2C163FC5743BBFC5A72F20F040670CDEB509
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA224.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):5.86552932624144
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:V1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOhwgjxo:XjwyJUYToZwOLuzDNU1j
                                                                                                                                                                                                                                        MD5:92587A131875FF7DC137AA6195B8BD81
                                                                                                                                                                                                                                        SHA1:2BA642DDC869AB329893795704BFE3F23C7B6ECB
                                                                                                                                                                                                                                        SHA-256:D2A9484134A65EFF74F0BDA9BB94E19C4964B6C323667D68B4F45BB8A7D499FC
                                                                                                                                                                                                                                        SHA-512:62823A0168B415045A093ACC67E98B5E33908380860B04AA0568B04F39DE957DA30F929459C766DC9782EFC3143DCD2F4950E3876669E680B6910C213300B565
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...F..e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA256.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):5.867427817795374
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:b1jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNWegjxo:ZjwyJOYToZwOLuzDNW7j
                                                                                                                                                                                                                                        MD5:B4E18C9A88A241FD5136FAF33FB9C96A
                                                                                                                                                                                                                                        SHA1:077AF274AA0336880391E2F38C873A72BFC1DE3B
                                                                                                                                                                                                                                        SHA-256:E50DB07E18CB84827B0D55C7183CF580FB809673BCAFBCEF60E83B4899F3AA74
                                                                                                                                                                                                                                        SHA-512:81A059115627025A7BBF8743B48031619C13A513446B0D035AA25037E03B6A544E013CAAEB139B1BE9BA7D0D8CF28A5E7D4CD1B8E17948830E75BDFBD6AF1653
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...D..e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA384.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):27136
                                                                                                                                                                                                                                        Entropy (8bit):5.860145427724178
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:TFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDFfgjVx2:xDLh98jjRe+1WT1aAeIfMzxH2mDDqj
                                                                                                                                                                                                                                        MD5:34A0AD8A0EB6AC1E86DC8629944448ED
                                                                                                                                                                                                                                        SHA1:EF54E4C92C123BE341567A0ACC17E4CEE7B9F7A8
                                                                                                                                                                                                                                        SHA-256:03E93C2DCC19C3A0CDD4E8EFCDE90C97F6A819DFECF1C96495FDC7A0735FAA97
                                                                                                                                                                                                                                        SHA-512:A38EDE4B46DC9EFA80DFB6E019379809DF78A671F782660CD778427482B0F5987FA80A42C26FB367604BAFCD4FD21ABD1C833DAF2D4AEA3A43877F54D6906E21
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...G..e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_SHA512.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):27136
                                                                                                                                                                                                                                        Entropy (8bit):5.916758045478156
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:LFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXCElrgjhig:5YLB9Mgj0e+1WT1aAeIfMzx320DXR+j
                                                                                                                                                                                                                                        MD5:F028511CD5F2F925FD5A979152466CB4
                                                                                                                                                                                                                                        SHA1:38B8B44089B390E1F3AA952C950BDBE2CB69FBA5
                                                                                                                                                                                                                                        SHA-256:0FB591416CC9520C6D9C398E1EDF4B7DA412F80114F80628F84E9D4D37A64F69
                                                                                                                                                                                                                                        SHA-512:97C06A4DCEE7F05268D0A47F88424E28B063807FFBD94DABDCC3BF773AD933A549934916EB7339506624E97829AA5DC13321ADE31D528E8424FFDCF8C8407D4F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...I..e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):5.0002940201841
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:Dz/RF/1nb2mhQtk4axusjfkgZhoYDQmRjcqgQvEty:Dz/d2f64axnTTz5DTgQvEty
                                                                                                                                                                                                                                        MD5:87C1C89CEB6DF9F62A8F384474D27A4A
                                                                                                                                                                                                                                        SHA1:B0FC912A8DE5D9C18F603CD25AE3642185FFFBDD
                                                                                                                                                                                                                                        SHA-256:D2256A5F1D3DC6AE38B73EA2DB87735724D29CB400D00D74CF8D012E30903151
                                                                                                                                                                                                                                        SHA-512:C7DFB9C8E4F4AA984416BC84E829F0BB6CD87829C86BA259EE2A9BAB7C16B15362DB9EC87BF2ACED44A6BED7B1DE03DC9450665D083205B4CD4780DCF480DA01
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...K..e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.025717576776578
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:FF/1nb2mhQtks0iiNqdF4mtPjD0HA5APYcqgYvEL2x:R2f6fFA/4GjDucgYvEL2x
                                                                                                                                                                                                                                        MD5:20702216CDA3F967DF5C71FCE8B9B36F
                                                                                                                                                                                                                                        SHA1:4D9A814EE2941A175BC41F21283899D05831B488
                                                                                                                                                                                                                                        SHA-256:3F73F9D59EB028B7F17815A088CEB59A66D6784FEEF42F2DA08DD07DF917DD86
                                                                                                                                                                                                                                        SHA-512:0802CF05DAD26E6C5575BBECB419AF6C66E48ED878F4E18E9CEC4F78D6358D751D41D1F0CCB86770A46510B993B70D2B320675422A6620CE9843E2E42193DCD8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_keccak.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):16384
                                                                                                                                                                                                                                        Entropy (8bit):5.235441330454107
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:VTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gD/gvrjcqgCieT3WQ:VafgNpj9cHW3jqXeBRamD4ZgCieT
                                                                                                                                                                                                                                        MD5:F065FFB04F6CB9CDB149F3C66BC00216
                                                                                                                                                                                                                                        SHA1:B2BC4AF8A3E06255BAB15D1A8CF4A577523B03B6
                                                                                                                                                                                                                                        SHA-256:E263D7E722EC5200E219D6C7D8B7C1B18F923E103C44A0B5485436F7B778B7BD
                                                                                                                                                                                                                                        SHA-512:93E583B10D0F2BBB1D5539FF4E943A65BC67F6DFC51E5F991481574F58757F4D49A87022E551069F6FC55D690F7B1412CF5DE7DD9BEE27FB826853CE9ACC2B40
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...J..e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Hash\_poly1305.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.133851517560629
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:zZNGXEgvUh43G6coX2SSwmPL4V7wTdDlDaY2cqgWjvE:mVMhuGGF2L4STdDEYWgWjvE
                                                                                                                                                                                                                                        MD5:213AAEC146F365D950014D7FFF381B06
                                                                                                                                                                                                                                        SHA1:66FCD49E5B2278CD670367A4AC6704A59AE82B50
                                                                                                                                                                                                                                        SHA-256:CAF315A9353B2306880A58ECC5A1710BFE3AA35CFEAD7CF0528CAEE4A0629EAD
                                                                                                                                                                                                                                        SHA-512:0880D7D2B2C936A4B85E6C2A127B3509B76DB4751A3D8A7BB903229CABC8DE7A7F52888D67C886F606E21400DFC51C215D1CF9C976EB558EA70975412840883A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...K..e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Math\_modexp.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):35840
                                                                                                                                                                                                                                        Entropy (8bit):5.927928056434685
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:KbEkzS7+k9rMUb8cOe9rs9ja+V/Mhxh56GS:KbEP779rMtcOCs0I/Mjf
                                                                                                                                                                                                                                        MD5:732938D696EB507AF4C37795A4F9FCEA
                                                                                                                                                                                                                                        SHA1:FD585EA8779C305ADBE3574BE95CFD06C9BBD01C
                                                                                                                                                                                                                                        SHA-256:1383269169AB4D2312C52BF944BD5BB80A36D378FD634D7C1B8C3E1FFC0F0A8C
                                                                                                                                                                                                                                        SHA-512:E4EBC5470F3D05D79B65BC2752A7FF40F5525CD0813BDDECCB1042EE2286B733EE172383186E89361A49CBE0B4B14F8B2CBC0F32E475101385C634120BB36676
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.^...0......`.....................................................`..........................................~..|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.799297116284292
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:UkCfXASTMeAk4OepIXcADpOX6RcqgO5vE:+JMcPepIXcADq63gO5vE
                                                                                                                                                                                                                                        MD5:9E7B28D6AB7280BBB386C93EF490A7C1
                                                                                                                                                                                                                                        SHA1:B088F65F3F6E2B7D07DDBE86C991CCD33535EF09
                                                                                                                                                                                                                                        SHA-256:F84667B64D9BE1BCC6A91650ABCEE53ADF1634C02A8A4A8A72D8A772432C31E4
                                                                                                                                                                                                                                        SHA-512:16A6510B403BF7D9ED76A654D8C7E6A0C489B5D856C231D12296C9746AC51CD372CC60CA2B710606613F7BC056A588C54EA24F9C0DA3020BBEA43E43CEEB9CA4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...P..e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):754688
                                                                                                                                                                                                                                        Entropy (8bit):7.6249603206444005
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:l1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6hM:XYmzHoxJFf1p34hcrn5Go9yQO6q
                                                                                                                                                                                                                                        MD5:102898D47B45548E7F7E5ECC1D2D1FAA
                                                                                                                                                                                                                                        SHA1:DDAE3A3BDD8B83AF42126245F6CB24DC2202BC04
                                                                                                                                                                                                                                        SHA-256:C9BF3CF5707793C6026BFF68F2681FAAD29E953ED891156163CD0B44A3628A92
                                                                                                                                                                                                                                        SHA-512:85A42FC08C91AFF50A9FF196D6FE8ABD99124557341B9809B62A639957B166C2A7EFEA0A042BE2D753464DF5908DF4F5FE01A91C239B744CD44A70B79EF81048
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d...R..e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):27648
                                                                                                                                                                                                                                        Entropy (8bit):5.792776923715812
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:mBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsla15gkbQ0e1:cL/g28Ufsxg9GmvPauYLxtX1D8kf
                                                                                                                                                                                                                                        MD5:717DA232A3A9F0B94AF936B30B59D739
                                                                                                                                                                                                                                        SHA1:F1B3676E708696585FBCB742B863C5BB913D923F
                                                                                                                                                                                                                                        SHA-256:B3FD73D54079903C0BE39BA605ED9BB58ECD1D683CCB8821D0C0CC795165B0C6
                                                                                                                                                                                                                                        SHA-512:7AF46035F9D4A5786ED3CE9F97AC33637C3428EF7183DED2AFD380265FAE6969BB057E3B5D57C990DD083A9DB2A67BEA668D4215E78244D83D7EE7E0A7B40143
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d...R..e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):67072
                                                                                                                                                                                                                                        Entropy (8bit):6.060435635420756
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:YqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxROpq:YqctkGACFI5t35q2JbgrwwOoqLTM9rMq
                                                                                                                                                                                                                                        MD5:ADF96805C070920EA90D9AB4D1E35807
                                                                                                                                                                                                                                        SHA1:D8FA8E29D9CDCD678DC03DA527EAF2F0C3BEF21A
                                                                                                                                                                                                                                        SHA-256:A36B1EDC104136E12EB6F28BD9366D30FFCEC0434684DC139314723E9C549FB7
                                                                                                                                                                                                                                        SHA-512:FB67C1F86CF46A63DF210061D16418589CD0341A6AA75AB49F24F99AD3CFF874BB02664706B9E2C81B7EF7300AF5BB806C412B4F069D22B72F7D9EBFFF66FE61
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\PublicKey\_x25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.488514144301916
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:IpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADBhDTAbcX6gn/7EC:uVddiT7pgTctdErDDDTicqgn/7
                                                                                                                                                                                                                                        MD5:148E1600E9CBAF6702D62D023CAC60BC
                                                                                                                                                                                                                                        SHA1:4CDD8445408C4165B6E029B9966C71BC45E634A2
                                                                                                                                                                                                                                        SHA-256:1461AAFD4B9DC270128C89C3EB5358794C77693BB943DC7FC42AA3BB0FC52B16
                                                                                                                                                                                                                                        SHA-512:53155DA3FD754AF0BC30E2A51F0B579B8A83A772025CE0B4AFD01A31B8A40F46533FDA9CC3D0D32E9480DBBD7DD4A28F9DAAC11A370B0435E5E74666ACF9181C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d...R..e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.731194408014124
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:lJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGybMZYJWJcX6gbW6s:JVddiT7pgTctEEaEDKDuMCWJcqgbW6
                                                                                                                                                                                                                                        MD5:1547F8CB860AB6EA92B85D4C1B0209A1
                                                                                                                                                                                                                                        SHA1:C5AE217DEE073AC3D23C3BF72EE26D4C7515BD88
                                                                                                                                                                                                                                        SHA-256:1D2F3E627551753E58ED9A85F8D23716F03B51D8FB5394C4108EB1DC90DC9185
                                                                                                                                                                                                                                        SHA-512:40F0B46EE837E4568089D37709EF543A987411A17BDBAE93D8BA9F87804FB34DCA459A797629F34A5B3789B4D89BD46371AC4F00DDFE5D6B521DEA8DC2375115
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Cryptodome\Util\_strxor.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.686131723746002
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:EiZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DmWMoG4BcX6gbW6O:HVddiT7pgTctEEO3DcoHcqgbW6
                                                                                                                                                                                                                                        MD5:16F42DE194AAEFB2E3CDEE7FA63D2401
                                                                                                                                                                                                                                        SHA1:BE2AB72A90E0342457A9D13BE5B6B1984875EDEA
                                                                                                                                                                                                                                        SHA-256:61E23970B6CED494E11DC9DE9CB889C70B7FF7A5AFE5242BA8B29AA3DA7BC60E
                                                                                                                                                                                                                                        SHA-512:A671EA77BC8CA75AEDB26B73293B51B780E26D6B8046FE1B85AE12BC9CC8F1D2062F74DE79040AD44D259172F99781C7E774FE40768DC0A328BD82A48BF81489
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...P..e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin\mfc140u.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5653536
                                                                                                                                                                                                                                        Entropy (8bit):6.729079283804055
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
                                                                                                                                                                                                                                        MD5:CD1D99DF975EE5395174DF834E82B256
                                                                                                                                                                                                                                        SHA1:F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
                                                                                                                                                                                                                                        SHA-256:D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
                                                                                                                                                                                                                                        SHA-512:397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\Pythonwin\win32ui.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1143296
                                                                                                                                                                                                                                        Entropy (8bit):6.0410832425584795
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:dk6co2gGIs7ZetrV6LMEsKK+Onc8fUqzFVVppS6yZAXz:dkG2QQetrgsK79qzFHL
                                                                                                                                                                                                                                        MD5:F0116137D0674482247D056642DC06BF
                                                                                                                                                                                                                                        SHA1:5BB63FCF5E569D94B61383D1921F758BCC48EF81
                                                                                                                                                                                                                                        SHA-256:8ECA3ED313003D3F3DEE1B7A5CE90B50E8477EC6E986E590E5ED91C919FC7564
                                                                                                                                                                                                                                        SHA-512:A8D6420C491766302C615E38DAF5D9B1698E5765125FD256530508E5C0A5675A7BF2F338A22368E0B4DDFA507D8D377507376C477CF9B829E28F3C399203CDE6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.K.K...K...K...3]..K..Y>...K.......K...3...K...>...K...>...K...>...K...K...M...>...K..Y>...K..Y>...K..Y>1..K..Y>...K..Rich.K..........................PE..d......g.........." .........r......4.....................................................`.........................................`....T..hr..h...............................l\......T.......................(.......8................0...........................text............................... ..`.rdata..|...........................@..@.data...............................@....pdata...............d..............@..@.rsrc...............................@..@.reloc..l\.......^..................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\VCRUNTIME140.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):109392
                                                                                                                                                                                                                                        Entropy (8bit):6.641929675972235
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
                                                                                                                                                                                                                                        MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
                                                                                                                                                                                                                                        SHA1:489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
                                                                                                                                                                                                                                        SHA-256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
                                                                                                                                                                                                                                        SHA-512:D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):49520
                                                                                                                                                                                                                                        Entropy (8bit):6.65700274508223
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
                                                                                                                                                                                                                                        MD5:7E668AB8A78BD0118B94978D154C85BC
                                                                                                                                                                                                                                        SHA1:DBAC42A02A8D50639805174AFD21D45F3C56E3A0
                                                                                                                                                                                                                                        SHA-256:E4B533A94E02C574780E4B333FCF0889F65ED00D39E32C0FBBDA2116F185873F
                                                                                                                                                                                                                                        SHA-512:72BB41DB17256141B06E2EAEB8FC65AD4ABDB65E4B5F604C82B9E7E7F60050734137D602E0F853F1A38201515655B6982F2761EE0FA77C531AA58591C95F0032
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d....J.$.........." ...".<...8.......A....................................................`A........................................0m.......m..x....................r..pO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_asyncio.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):65304
                                                                                                                                                                                                                                        Entropy (8bit):6.186523609819811
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:k2icaMc907zrzE6+gTKnEzhIVOnZC7SyMx6:k2icrc4HE6+gTOEzhIVOn0j
                                                                                                                                                                                                                                        MD5:CEE78DC603D57CB2117E03B2C0813D84
                                                                                                                                                                                                                                        SHA1:095C98CA409E364B8755DC9CFD12E6791BF6E2B8
                                                                                                                                                                                                                                        SHA-256:6306BE660D87FFB2271DD5D783EE32E735A792556E0B5BD672DC0B1C206FDADC
                                                                                                                                                                                                                                        SHA-512:7258560AA557E3E211BB9580ADD604B5191C769594E17800B2793239DF45225A82CE440A6B9DCF3F2228ED84712912AFFE9BF0B70B16498489832DF2DEE33E7E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:'T.[I..[I..[I..#...[I..'H..[I..'L..[I..'M..[I..'J..[I..&H..[I.M#H..[I..[H..[I..&D..[I..&I..[I..&...[I..&K..[I.Rich.[I.........PE..d......e.........." ...#.R..........`.....................................................`.............................................P...`...d......................../..........`w..T........................... v..@............p...............................text....P.......R.................. ..`.rdata..~J...p...L...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_brotli.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):820736
                                                                                                                                                                                                                                        Entropy (8bit):6.056263694016779
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:cY0Uu7wLsglBv4i5DGAqXMAHhlyL82XTw05nmZfR7o:cp0NA1tAmZfR
                                                                                                                                                                                                                                        MD5:D9FC15CAF72E5D7F9A09B675E309F71D
                                                                                                                                                                                                                                        SHA1:CD2B2465C04C713BC58D1C5DE5F8A2E13F900234
                                                                                                                                                                                                                                        SHA-256:1FCD75B03673904D9471EC03C0EF26978D25135A2026020E679174BDEF976DCF
                                                                                                                                                                                                                                        SHA-512:84F705D52BD3E50AC412C8DE4086C18100EAC33E716954FBCB3519F4225BE1F4E1C3643D5A777C76F7112FAE30CE428E0CE4C05180A52842DACB1F5514460006
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ls...........u......q......u......q......q......q.....Yq...........Hp.....Hp.....Hp.....Hp.....Rich............................PE..d......d.........." ...#.@...H.......F....................................................`.........................................@c..`....c.......................................9..............................P8..@............P...............................text....?.......@.................. ..`.rdata.......P.......D..............@..@.data........p.......`..............@....pdata...............h..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_bz2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):84760
                                                                                                                                                                                                                                        Entropy (8bit):6.56801864004604
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:7/Uez7qlMjca6uPZLPYMPHn3m8bhztpIVCVC7SyhJDxhy:4ezGC4TM/3RbhhpIVCVCXpy
                                                                                                                                                                                                                                        MD5:28EDE9CE9484F078AC4E52592A8704C7
                                                                                                                                                                                                                                        SHA1:BCF8D6FE9F42A68563B6CE964BDC615C119992D0
                                                                                                                                                                                                                                        SHA-256:403E76FE18515A5EA3227CF5F919AA2F32AC3233853C9FB71627F2251C554D09
                                                                                                                                                                                                                                        SHA-512:8C372F9F6C4D27F7CA9028C6034C17DEB6E98CFEF690733465C1B44BD212F363625D9C768F8E0BD4C781DDDE34EE4316256203ED18FA709D120F56DF3CCA108B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d......e.........." ...#.....^..............................................P.......U....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_cffi_backend.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):178176
                                                                                                                                                                                                                                        Entropy (8bit):6.165902427203749
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:87aw5iwiVHprp0+/aSdXUONX9dAXS7qkSTLkKh23/qZl:87kBVHplaSdRj4LkSTLLhW/q
                                                                                                                                                                                                                                        MD5:739D352BD982ED3957D376A9237C9248
                                                                                                                                                                                                                                        SHA1:961CF42F0C1BB9D29D2F1985F68250DE9D83894D
                                                                                                                                                                                                                                        SHA-256:9AEE90CF7980C8FF694BB3FFE06C71F87EB6A613033F73E3174A732648D39980
                                                                                                                                                                                                                                        SHA-512:585A5143519ED9B38BB53F912CEA60C87F7CE8BA159A1011CF666F390C2E3CC149E0AC601B008E039A0A78EAF876D7A3F64FFF612F5DE04C822C6E214BC2EFDE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A:.#.[.p.[.p.[.p.#.p.[.p..q.[.p..zp.[.p..q.[.p..q.[.p..q.[.pN#.q.[.pj.q.[.p.[.p.[.pM.q.[.p.#.p.[.pM.q.[.pM.xp.[.pM.q.[.pRich.[.p................PE..d......f.........." ...).....B............................................... ............`.........................................PX..l....X.......................................?...............................=..@............................................text...X........................... ..`.rdata..............................@..@.data....].......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_ctypes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):123672
                                                                                                                                                                                                                                        Entropy (8bit):6.0601189161591
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:aS7u5LnIxdP3fPHW+QfLIrAYKpemW9IVLPjo:aSw+3FQfLIrIemW3
                                                                                                                                                                                                                                        MD5:22C4892CAF560A3EE28CF7F210711F9E
                                                                                                                                                                                                                                        SHA1:B30520FADD882B667ECEF3B4E5C05DC92E08B95A
                                                                                                                                                                                                                                        SHA-256:E28D4E46E5D10B5FDCF0292F91E8FD767E33473116247CD5D577E4554D7A4C0C
                                                                                                                                                                                                                                        SHA-512:EDB86B3694FFF0B05318DECF7FC42C20C348C1523892CCE7B89CC9C5AB62925261D4DD72D9F46C9B2BDA5AC1E6B53060B8701318B064A286E84F817813960B19
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................).....).....).....).....O...............W.......c.O.....O.....O.o...O.....Rich..........................PE..d......e.........." ...#............p\..............................................jh....`.........................................pP.......P.........................../..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_decimal.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):253720
                                                                                                                                                                                                                                        Entropy (8bit):6.551075270762715
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:cjz3B48pj9aOtoQdpJOsoTiSi9qWM53pLW1Atp6tQh7:i94uj9afQVrom0bUQh7
                                                                                                                                                                                                                                        MD5:BAAA9067639597E63B55794A757DDEFF
                                                                                                                                                                                                                                        SHA1:E8DD6B03EBEF0B0A709E6CCCFF0E9F33C5142304
                                                                                                                                                                                                                                        SHA-256:6CD52B65E11839F417B212BA5A39F182B0151A711EBC7629DC260B532391DB72
                                                                                                                                                                                                                                        SHA-512:7995C3B818764AD88DB82148EA0CE560A0BBE9594CA333671B4C5E5C949F5932210EDBD63D4A0E0DC2DAF24737B99318E3D5DAAEE32A5478399A6AA1B9EE3719
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d......e.........." ...#.x...<......<...............................................:.....`......................................... T..P...pT..................$'......./......P.......T...........................P...@............................................text....v.......x.................. ..`.rdata..l............|..............@..@.data....*...p...$...T..............@....pdata..$'.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_hashlib.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):65304
                                                                                                                                                                                                                                        Entropy (8bit):6.2555709687934655
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:jfKlbLgy209/MkZy6n23JZlnvy7OjZophIVOIi7SyMrxZR1:7Khgy+XZla7OjSphIVOIiKR1
                                                                                                                                                                                                                                        MD5:C888ECC8298C36D498FF8919CEBDB4E6
                                                                                                                                                                                                                                        SHA1:F904E1832B9D9614FA1B8F23853B3E8C878D649D
                                                                                                                                                                                                                                        SHA-256:21D59958E2AD1B944C4811A71E88DE08C05C5CA07945192AB93DA5065FAC8926
                                                                                                                                                                                                                                        SHA-512:7161065608F34D6DE32F2C70B7485C4EE38CD3A41EF68A1BEACEE78E4C5B525D0C1347F148862CF59ABD9A4AD0026C2C2939736F4FC4C93E6393B3B53AA7C377
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(t..F'..F'..F'..'..F'u.G&..F'u.C&..F'u.B&..F'u.E&..F'..G&..F'..G&..F'..G'B.F'..K&..F'..F&..F'...'..F'..D&..F'Rich..F'................PE..d......e.........." ...#.T...~......@@..............................................H.....`............................................P... ............................/......X...P}..T............................|..@............p..0............................text....S.......T.................. ..`.rdata...O...p...P...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_lzma.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159000
                                                                                                                                                                                                                                        Entropy (8bit):6.849076584495919
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:cNltLBrdV/REWa/g7Lznf49mNoiUMApqlpIVZ1SXW:cNltPpREgAYOicMI
                                                                                                                                                                                                                                        MD5:D386B7C4DCF589E026ABFC7196CF1C4C
                                                                                                                                                                                                                                        SHA1:C07CE47CE0E69D233C5BDD0BCAC507057D04B2D4
                                                                                                                                                                                                                                        SHA-256:AD0440CA6998E18F5CC917D088AF3FEA2C0FF0FEBCE2B5E2B6C0F1370F6E87B1
                                                                                                                                                                                                                                        SHA-512:78D79E2379761B054DF1F9FD8C5B7DE5C16B99AF2D2DE16A3D0AC5CB3F0BD522257579A49E91218B972A273DB4981F046609FDCF2F31CF074724D544DAC7D6C8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T"#.5Lp.5Lp.5Lp.M.p.5Lp.IMq.5Lp.IIq.5Lp.IHq.5Lp.IOq.5LpnHMq.5Lp.MMq.5Lp.5Mp.5LpnHAq.5LpnHLq.5LpnH.p.5LpnHNq.5LpRich.5Lp................PE..d......e.........." ...#.b...........5....................................................`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text...na.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_multiprocessing.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):34584
                                                                                                                                                                                                                                        Entropy (8bit):6.408696570061904
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:n7I6Rwcl5w5zu8TdywGnJjRIVWtTk5YiSyvE+OAMxkEO:7Ikl5kzu8TdywGJjRIVWtTu7Sy18xK
                                                                                                                                                                                                                                        MD5:622A0E73779C88FC430B69CAF4A39789
                                                                                                                                                                                                                                        SHA1:F6536137E4E2CD8EC181F09B7DBA5E2E4D03B392
                                                                                                                                                                                                                                        SHA-256:EDFA9EE414F41448F8FFABB79F3BB8DB5C25E1CFD28FACF88EB5FE2D1E1D7551
                                                                                                                                                                                                                                        SHA-512:FD8D6DB53B630821845DFE22B09C4335565F848A421AF271797EFE272BAAA1EF887D735D4D5CD7D1258F2DD8F523327A67C071F7D16FC1BF53ACA39BAE41DFF2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-*.yCy.yCy.yCy...y.yCy'.Bx.yCy'.Fx.yCy'.Gx.yCy'.@x.yCyA.Bx.yCy.yBy.yCy..Bx.yCyA.Nx.yCyA.Cx.yCyA..y.yCyA.Ax.yCyRich.yCy................PE..d......e.........." ...#.....<......0...............................................E.....`.........................................0D..`....D..x....p.......`.......X.../...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_overlapped.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):50968
                                                                                                                                                                                                                                        Entropy (8bit):6.434106091606417
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:R1FMCcP4W9vqJKRJs2lNXSkCirb1IVXtW5YiSyvw5AMxkEfEk:R1FMaJKWkCg1IVXts7Sy4hxjEk
                                                                                                                                                                                                                                        MD5:D3BE208DC5388225162B6F88FF1D4386
                                                                                                                                                                                                                                        SHA1:8EFFDB606B6771D5FDF83145DE0F289E8AD83B69
                                                                                                                                                                                                                                        SHA-256:CE48969EBEBDC620F4313EBA2A6B6CDA568B663C09D5478FA93826D401ABE674
                                                                                                                                                                                                                                        SHA-512:9E1C3B37E51616687EECF1F7B945003F6EB4291D8794FEA5545B4A84C636007EB781C18F6436039DF02A902223AC73EFAC9B2E44DDC8594DB62FEB9997475DA3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}!{..O(..O(..O(.d.(..O(W`N)..O(W`J)..O(W`K)..O(W`L)..O(1aN)..O(..N(..O(.dN)..O(.dK)..O(1aB)..O(1aO)..O(1a.(..O(1aM)..O(Rich..O(................PE..d......e.........." ...#.B...X.......................................................N....`.........................................0...X................................/......,....f..T...........................Pe..@............`...............................text...fA.......B.................. ..`.rdata..$5...`...6...F..............@..@.data................|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_queue.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):32536
                                                                                                                                                                                                                                        Entropy (8bit):6.447318282610391
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:P0+yFg6rXtUmxU99IVQUT5YiSyvyxAMxkE44:c+wRXiWU99IVQUd7Sy+xE4
                                                                                                                                                                                                                                        MD5:50842CE7FCB1950B672D8A31C892A5D1
                                                                                                                                                                                                                                        SHA1:D84C69FA2110B860DA71785D1DBE868BD1A8320F
                                                                                                                                                                                                                                        SHA-256:06C36EC0749D041E6957C3CD7D2D510628B6ABE28CEE8C9728412D9CE196A8A2
                                                                                                                                                                                                                                        SHA-512:C1E686C112B55AB0A5E639399BD6C1D7ADFE6AEDC847F07C708BEE9F6F2876A1D8F41EDE9D5E5A88AC8A9FBB9F1029A93A83D1126619874E33D09C5A5E45A50D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:WX.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.L[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........PE..d......e.........." ...#.....8......................................................(F....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_socket.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):79640
                                                                                                                                                                                                                                        Entropy (8bit):6.28999572337647
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:YJlhpHrTT9r3ujE9/s+S+pzpCoiTFVf7p9IVLwg7SyLxU:Y7hpL13ujE9/sT+pz4oYFVTp9IVLwgo
                                                                                                                                                                                                                                        MD5:2C0EC225E35A0377AC1D0777631BFFE4
                                                                                                                                                                                                                                        SHA1:7E5D81A06FF8317AF52284AEDCCAC6EBACE5C390
                                                                                                                                                                                                                                        SHA-256:301C47C4016DAC27811F04F4D7232F24852EF7675E9A4500F0601703ED8F06AF
                                                                                                                                                                                                                                        SHA-512:AEA9D34D9E93622B01E702DEFD437D397F0E7642BC5F9829754D59860B345BBDE2DD6D7FE21CC1D0397FF0A9DB4ECFE7C38B649D33C5C6F0EAD233CB201A73E0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.+.".E.".E.".E.+...$.E...D. .E...@./.E...A.*.E...F.!.E...D. .E.".D...E.i.D.%.E...H.#.E...E.#.E....#.E...G.#.E.Rich".E.........................PE..d......e.........." ...#.l...........%.......................................P............`.............................................P............0....... ..x......../...@..........T...............................@............................................text...6k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_sqlite3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):120088
                                                                                                                                                                                                                                        Entropy (8bit):6.2579260754206505
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:vvtiqaiN2oSNMAwwi3CLl147ZvV9NdrRvdO5yFAuaUVMJF8MYRnchIVOQ1B:HJaiN2oSNVDD5FJFr2
                                                                                                                                                                                                                                        MD5:A70731AE2CA44B7292623AE8B0281549
                                                                                                                                                                                                                                        SHA1:9E086C0753BB43E2876C33C4872E71808932A744
                                                                                                                                                                                                                                        SHA-256:55344349F9199AEDAD1737A0311CBE2C3A4BF9494B76982520BACAD90F463C1B
                                                                                                                                                                                                                                        SHA-512:8334104DF9837D32946965290BBC46BA0A0ADA17BD2D03FC63380979F5FC86B26BE245636718B4304DFD0D85A5B3F7170614F148E5C965CC5ADF59D34465F7F1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`.g...g...g.......g.......g.....g.......g.......g.......g..q....g.......g...g...f..q....g..q....g..q..g..q....g..Rich.g..........................PE..d......e.........." ...#............................................................ G....`..........................................Z..P....Z.........................../..............T...........................p...@............................................text............................... ..`.rdata..l...........................@..@.data................n..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_ssl.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):176920
                                                                                                                                                                                                                                        Entropy (8bit):5.955624236034285
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:pjIQQSFBfL+SiSVWuXa6XzfBJ9d41Olh59YL48PMrN/WgAlNcLpIVC72a:CSFNL3LJa6Xzj4BLcLP
                                                                                                                                                                                                                                        MD5:66E78727C2DA15FD2AAC56571CD57147
                                                                                                                                                                                                                                        SHA1:E93C9A5E61DB000DEE0D921F55F8507539D2DF3D
                                                                                                                                                                                                                                        SHA-256:4727B60962EFACFD742DCA21341A884160CF9FCF499B9AFA3D9FDBCC93FB75D0
                                                                                                                                                                                                                                        SHA-512:A6881F9F5827ACEB51957AAED4C53B69FCF836F60B9FC66EEB2ED84AED08437A9F0B35EA038D4B1E3C539E350D9D343F8A6782B017B10A2A5157649ABBCA9F9A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.+.4.x.4.x.4.x.L)x.4.x.H.y.4.x.H.y.4.x.H.y.4.x.H.y.4.xiI.y.4.x.4.x>5.x.L.y.4.xiI.y.4.xiI.y.4.xiIEx.4.xiI.y.4.xRich.4.x................PE..d......e.........." ...#............l+...............................................!....`.........................................0...d................................/......|...P...T...............................@............................................text............................... ..`.rdata...".......$..................@..@.data...............................@....pdata...............\..............@..@.rsrc................h..............@..@.reloc..|............r..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\_uuid.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):25368
                                                                                                                                                                                                                                        Entropy (8bit):6.628339287223099
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:lCfwFpEWjfivQpIVZwobHQIYiSy1pCQFjzuAM+o/8E9VF0NySoJ:4qpEI4QpIVZwg5YiSyvgAMxkE7
                                                                                                                                                                                                                                        MD5:3A09B6DB7E4D6FF0F74C292649E4BA96
                                                                                                                                                                                                                                        SHA1:1A515F98946A4DCCC50579CBCEDF959017F3A23C
                                                                                                                                                                                                                                        SHA-256:FC09E40E569F472DD4BA2EA93DA48220A6B0387EC62BB0F41F13EF8FAB215413
                                                                                                                                                                                                                                        SHA-512:8D5EA9F7EEE3D75F0673CC7821A94C50F753299128F3D623E7A9C262788C91C267827C859C5D46314A42310C27699AF5CDFC6F7821DD38BF03C0B35873D9730F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<p.R#.R#.R#...#.R#i.S".R#i.W".R#i.V".R#i.Q".R#..S".R#..S".R#.S#..R#..Z".R#..R".R#...#.R#..P".R#Rich.R#........................PE..d......e.........." ...#.....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_helpers.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):51712
                                                                                                                                                                                                                                        Entropy (8bit):5.719745861304906
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:V1yQoUZM+e7B244LM1/sGFNUgOclIgD0iEXSmHN9D7KSDq/dFGlaKb+DzH:VloBBN4LM1/9FeiIyEXX9XKSEFAb+n
                                                                                                                                                                                                                                        MD5:ADD987AEC610B3D921DECBEF60E0DE8D
                                                                                                                                                                                                                                        SHA1:2763D5D3ACF58BC751323310F1F46ABCBC093C82
                                                                                                                                                                                                                                        SHA-256:AD5F49D13DDEA57319E9D404E8947B5207239D07D94332DFE601331A70A8D5EB
                                                                                                                                                                                                                                        SHA-512:D460AEA5256DE208CC0D13D59D05E809B3F5FD88C34731C776498113DA45B6FD732F00CC1C6E02B2F43992CBCD04598E48AEE140CA1C1E7FFDD3E8FF18238020
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.k...k...k....?..k......k.......k......k......k......k......k...k..Rk......k......k....S..k......k..Rich.k..........................PE..d..."B.g.........." ...).z...T.......|....................................... ............`.............................................`.......d...................................................................P...@............................................text...8y.......z.................. ..`.rdata...6.......6...~..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_http_parser.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):266240
                                                                                                                                                                                                                                        Entropy (8bit):6.171612984848152
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:BVuE3CWclftO4A1tgB9eIGnbQN4NFguNli5XURla2yBi2/1VDZoUyGRqpu:DV31clftOft+uNlQ/5isnKp
                                                                                                                                                                                                                                        MD5:57ABDBFC3F2020177909E20984032DD5
                                                                                                                                                                                                                                        SHA1:B814A1E284BF330F3387AFE0F1DC2CCF2B9B8016
                                                                                                                                                                                                                                        SHA-256:3A143C933FADD1A1A60A65BDD37858EA11D47A074F9A7934933B13C01B7C3B8B
                                                                                                                                                                                                                                        SHA-512:5CA9B1903E8AA7EA244A6807AC8107AD651AA6B16C444D420E9200D689D2A9FA9DAAC25BF937DEB9214CC0DD550E6F9231B4E8551AA0DC38D265A87B7DAE582E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B,6..MXY.MXY.MXY.5.Y.MXY..YX.MXYM5YX.MXYi.YX.MXY.MYY.MXY..[X.MXY..\X.MXY..]X.MXYN.PX.MXYN.XX.MXYN.Y.MXYN.ZX.MXYRich.MXY................PE..d..."B.g.........." ...).0...........1....................................................`.........................................p.......D...x....`.......@..0............p..\......................................@............@...............................text...X........0.................. ..`.rdata.."....@.......4..............@..@.data....F..........................@....pdata..0....@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_http_writer.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):49152
                                                                                                                                                                                                                                        Entropy (8bit):5.734133802541209
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:RuIpuGiOh9LHHQ2leaWYk/glLh2u+yBlhlr9iLr2F+HGlj55D2n8Ic:RuTGiK8a8Yl9z+yf9iH2F+H65B2n8Ic
                                                                                                                                                                                                                                        MD5:C5036E8B04879173F5E530F7B11C65BA
                                                                                                                                                                                                                                        SHA1:1F17B7551020575943B92058CC493B0C1A35D32C
                                                                                                                                                                                                                                        SHA-256:8D12BDD47DBABC836930A663A5149C4F2D2B9AE082F954EE26FE66D501FEBFE9
                                                                                                                                                                                                                                        SHA-512:07588B3E311ED1AEBD5BE0D96388FE180FED4629FE08EBCA4E86802B8AF3DAED603EABDB5AA427C2E5E80E384C5B3D859B0AC4438BD2A278E949DE6CE2FCE44B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..T.l...l...l....?..l......l..A....l......l......l......l..e...l...l...l..B...l..B...l..B.S..l..B...l..Rich.l..................PE..d...#B.g.........." ...).v...........x.......................................P............`.........................................p...h......d....0....... ..$............@......................................@...@...............X............................text...(u.......v.................. ..`.rdata...0.......2...z..............@..@.data...(N..........................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\aiohttp\_websocket.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36864
                                                                                                                                                                                                                                        Entropy (8bit):5.595737924373698
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:NTQTXEebmg5xAVNTTYMlam/Je5JAZ6cXu9lEQ/Yv8:hSP5KVV0MgF8G3/Yv
                                                                                                                                                                                                                                        MD5:EC9E2D8CC7966CACAC49DA5409BB72F7
                                                                                                                                                                                                                                        SHA1:EB0F500F21B7134EBC833CED27DF1450DB9EA241
                                                                                                                                                                                                                                        SHA-256:23391519E1BF052D4832ADA81BCA088C2B8BCE582F0EB3535109B524A2891E10
                                                                                                                                                                                                                                        SHA-512:FAA4A03CF4B0E7EB18412594F5199E57624099D4F53789BCD87CF2572F8F94636FADB8E99E3DEABBA57B2AB91427CDC7E239CF9D137D4EE3B31F6423E166F65B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.k...k...k....?..k......k.......k......k......k......k......k...k..rk......k......k....S..k......k..Rich.k..........................PE..d....B.g.........." ...).N...D...... P....................................................`..........................................|..d...t|..d...............4...................@s...............................r..@............`...............................text...xL.......N.................. ..`.rdata..:+...`...,...R..............@..@.data................~..............@....pdata..4...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-console-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22112
                                                                                                                                                                                                                                        Entropy (8bit):4.744270711412692
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:zFOhcWqhWpvWEXCVWQ4iWwklRxwVIX01k9z3AROVaz4ILS:zFlWqhWpk6R9zeU0J2
                                                                                                                                                                                                                                        MD5:E8B9D74BFD1F6D1CC1D99B24F44DA796
                                                                                                                                                                                                                                        SHA1:A312CFC6A7ED7BF1B786E5B3FD842A7EEB683452
                                                                                                                                                                                                                                        SHA-256:B1B3FD40AB437A43C8DB4994CCFFC7F88000CC8BB6E34A2BCBFF8E2464930C59
                                                                                                                                                                                                                                        SHA-512:B74D9B12B69DB81A96FC5A001FD88C1E62EE8299BA435E242C5CB2CE446740ED3D8A623E1924C2BC07BFD9AEF7B2577C9EC8264E53E5BE625F4379119BAFCC27
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....dZ..........." .........0...............................................@............`A........................................p...,............0...............0..`&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.602255667966723
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:NWqhWEWEXCVWQ4cRWvBQrVXC4dlgX01k9z3AUj7W6SxtR:NWqhWPlZVXC4deR9zVj7QR
                                                                                                                                                                                                                                        MD5:CFE0C1DFDE224EA5FED9BD5FF778A6E0
                                                                                                                                                                                                                                        SHA1:5150E7EDD1293E29D2E4D6BB68067374B8A07CE6
                                                                                                                                                                                                                                        SHA-256:0D0F80CBF476AF5B1C9FD3775E086ED0DFDB510CD0CC208EC1CCB04572396E3E
                                                                                                                                                                                                                                        SHA-512:B0E02E1F19CFA7DE3693D4D63E404BDB9D15527AC85A6D492DB1128BB695BFFD11BEC33D32F317A7615CB9A820CD14F9F8B182469D65AF2430FFCDBAD4BD7000
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....N7.........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.606873381830854
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:T0WqhWnWEXCVWQ4mW5ocADB6ZX01k9z3AkprGvV:T0WqhW8VcTR9zJpr4V
                                                                                                                                                                                                                                        MD5:33BBECE432F8DA57F17BF2E396EBAA58
                                                                                                                                                                                                                                        SHA1:890DF2DDDFDF3EECCC698312D32407F3E2EC7EB1
                                                                                                                                                                                                                                        SHA-256:7CF0944901F7F7E0D0B9AD62753FC2FE380461B1CCE8CDC7E9C9867C980E3B0E
                                                                                                                                                                                                                                        SHA-512:619B684E83546D97FC1D1BC7181AD09C083E880629726EE3AF138A9E4791A6DCF675A8DF65DC20EDBE6465B5F4EAC92A64265DF37E53A5F34F6BE93A5C2A7AE5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....IL..........." .........0...............................................@...........`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.65169290018864
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:qzmxD3T4qLWqhW2WJWadJCsVWQ4mW/xNVAv+cQ0GX01k9z3ARoanSwT44:qzQVWqhWTCsiNbZR9zQoUSwTJ
                                                                                                                                                                                                                                        MD5:EB0978A9213E7F6FDD63B2967F02D999
                                                                                                                                                                                                                                        SHA1:9833F4134F7AC4766991C918AECE900ACFBF969F
                                                                                                                                                                                                                                        SHA-256:AB25A1FE836FC68BCB199F1FE565C27D26AF0C390A38DA158E0D8815EFE1103E
                                                                                                                                                                                                                                        SHA-512:6F268148F959693EE213DB7D3DB136B8E3AD1F80267D8CBD7D5429C021ADACCC9C14424C09D527E181B9C9B5EA41765AFF568B9630E4EB83BFC532E56DFE5B63
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..H...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26216
                                                                                                                                                                                                                                        Entropy (8bit):4.866487428274293
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:gaNYPvVX8rFTsCWqhWVWEXCVWQ4mWPJlBLrp0KBQfX01k9z3ALkBw:WPvVX8WqhWiyBRxB+R9z2kBw
                                                                                                                                                                                                                                        MD5:EFAD0EE0136532E8E8402770A64C71F9
                                                                                                                                                                                                                                        SHA1:CDA3774FE9781400792D8605869F4E6B08153E55
                                                                                                                                                                                                                                        SHA-256:3D2C55902385381869DB850B526261DDEB4628B83E690A32B67D2E0936B2C6ED
                                                                                                                                                                                                                                        SHA-512:69D25EDF0F4C8AC5D77CB5815DFB53EAC7F403DC8D11BFE336A545C19A19FFDE1031FA59019507D119E4570DA0D79B95351EAC697F46024B4E558A0FF6349852
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....(............" .........@...............................................P......z.....`A........................................p................@...............@..h&..............p............................................................................rdata..|........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l1-2-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.619913450163593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:iDGaWqhWhWJWadJCsVWQ4mWd9afKUSIX01k9z3AEXzAU9:i6aWqhWACs92IR9z5EU9
                                                                                                                                                                                                                                        MD5:1C58526D681EFE507DEB8F1935C75487
                                                                                                                                                                                                                                        SHA1:0E6D328FAF3563F2AAE029BC5F2272FB7A742672
                                                                                                                                                                                                                                        SHA-256:EF13DCE8F71173315DFC64AB839B033AB19A968EE15230E9D4D2C9D558EFEEE2
                                                                                                                                                                                                                                        SHA-512:8EDB9A0022F417648E2ECE9E22C96E2727976332025C3E7D8F15BCF6D7D97E680D1BF008EB28E2E0BD57787DCBB71D38B2DEB995B8EDC35FA6852AB1D593F3D1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....RS.........." .........0...............................................@......;.....`A........................................p...L............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-file-l2-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):18696
                                                                                                                                                                                                                                        Entropy (8bit):7.054510010549814
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
                                                                                                                                                                                                                                        MD5:BFFFA7117FD9B1622C66D949BAC3F1D7
                                                                                                                                                                                                                                        SHA1:402B7B8F8DCFD321B1D12FC85A1EE5137A5569B2
                                                                                                                                                                                                                                        SHA-256:1EA267A2E6284F17DD548C6F2285E19F7EDB15D6E737A55391140CE5CB95225E
                                                                                                                                                                                                                                        SHA-512:B319CC7B436B1BE165CDF6FFCAB8A87FE29DE78F7E0B14C8F562BE160481FB5483289BD5956FDC1D8660DA7A3F86D8EEDE35C6CC2B7C3D4C852DECF4B2DCDB7F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0............`.........................................`................ ...................=..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.625331165566263
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:qzWqhWxWJWadJCsVWQ4mW8RJLNVAv+cQ0GX01k9z3ARo8ef3uBJu:qzWqhWwCsjNbZR9zQoEzu
                                                                                                                                                                                                                                        MD5:E89CDCD4D95CDA04E4ABBA8193A5B492
                                                                                                                                                                                                                                        SHA1:5C0AEE81F32D7F9EC9F0650239EE58880C9B0337
                                                                                                                                                                                                                                        SHA-256:1A489E0606484BD71A0D9CB37A1DC6CA8437777B3D67BFC8C0075D0CC59E6238
                                                                                                                                                                                                                                        SHA-512:55D01E68C8C899E99A3C62C2C36D6BCB1A66FF6ECD2636D2D0157409A1F53A84CE5D6F0C703D5ED47F8E9E2D1C9D2D87CC52585EE624A23D92183062C999B97E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....Hb..........." .........0...............................................@............`A........................................p...`............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.737397647066978
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:OdxlZWqhWcWJWadJCsVWQ4mWlhtFyttuX01k9z3A2oD:OdxlZWqhWpCsctkSR9zfoD
                                                                                                                                                                                                                                        MD5:ACCC640D1B06FB8552FE02F823126FF5
                                                                                                                                                                                                                                        SHA1:82CCC763D62660BFA8B8A09E566120D469F6AB67
                                                                                                                                                                                                                                        SHA-256:332BA469AE84AA72EC8CCE2B33781DB1AB81A42ECE5863F7A3CB5A990059594F
                                                                                                                                                                                                                                        SHA-512:6382302FB7158FC9F2BE790811E5C459C5C441F8CAEE63DF1E09B203B8077A27E023C4C01957B252AC8AC288F8310BCEE5B4DCC1F7FC691458B90CDFAA36DCBE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....B.l.........." .........0...............................................@.......A....`A........................................p................0...............0..x&..............p............................................................................rdata..|...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.6569647133331316
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dwWqhWWWEXCVWQ4mWLnySfKUSIX01k9z3AEXz5SLaDa3:iWqhWJhY2IR9z5YLt3
                                                                                                                                                                                                                                        MD5:C6024CC04201312F7688A021D25B056D
                                                                                                                                                                                                                                        SHA1:48A1D01AE8BC90F889FB5F09C0D2A0602EE4B0FD
                                                                                                                                                                                                                                        SHA-256:8751D30DF554AF08EF42D2FAA0A71ABCF8C7D17CE9E9FF2EA68A4662603EC500
                                                                                                                                                                                                                                        SHA-512:D86C773416B332945ACBB95CBE90E16730EF8E16B7F3CCD459D7131485760C2F07E95951AEB47C1CF29DE76AFFEB1C21BDF6D8260845E32205FE8411ED5EFA47
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...}.o..........." .........0...............................................@......v.....`A........................................p................0...............0..h&..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.882042129450427
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:9TvuBL3BBLAWqhWUWEXCVWQ4iWgdCLVx6RMySX01k9z3AzaXQ+BB:9TvuBL3BaWqhW/WSMR9zqaP
                                                                                                                                                                                                                                        MD5:1F2A00E72BC8FA2BD887BDB651ED6DE5
                                                                                                                                                                                                                                        SHA1:04D92E41CE002251CC09C297CF2B38C4263709EA
                                                                                                                                                                                                                                        SHA-256:9C8A08A7D40B6F697A21054770F1AFA9FFB197F90EF1EEE77C67751DF28B7142
                                                                                                                                                                                                                                        SHA-512:8CF72DF019F9FC9CD22FF77C37A563652BECEE0708FF5C6F1DA87317F41037909E64DCBDCC43E890C5777E6BCFA4035A27AFC1AEEB0F5DEBA878E3E9AEF7B02A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....g..........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):5.355894399765837
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:0naOMw3zdp3bwjGzue9/0jCRrndbnWqhW5lFydVXC4deR9zVj7xR:FOMwBprwjGzue9/0jCRrndbtGydVXC4O
                                                                                                                                                                                                                                        MD5:724223109E49CB01D61D63A8BE926B8F
                                                                                                                                                                                                                                        SHA1:072A4D01E01DBBAB7281D9BD3ADD76F9A3C8B23B
                                                                                                                                                                                                                                        SHA-256:4E975F618DF01A492AE433DFF0DD713774D47568E44C377CEEF9E5B34AAD1210
                                                                                                                                                                                                                                        SHA-512:19B0065B894DC66C30A602C9464F118E7F84D83010E74457D48E93AACA4422812B093B15247B24D5C398B42EF0319108700543D13F156067B169CCFB4D7B6B7C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...0.&3.........." .........0...............................................@......L0....`A........................................p................0...............0..h&..............p............................................................................rdata..D...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.771309314175772
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:L0WqhWTWEXCVWQ4cRWdmjKDUX01k9z3AQyMX/7kn:L0WqhWol1pR9zzDY
                                                                                                                                                                                                                                        MD5:3C38AAC78B7CE7F94F4916372800E242
                                                                                                                                                                                                                                        SHA1:C793186BCF8FDB55A1B74568102B4E073F6971D6
                                                                                                                                                                                                                                        SHA-256:3F81A149BA3862776AF307D5C7FEEF978F258196F0A1BF909DA2D3F440FF954D
                                                                                                                                                                                                                                        SHA-512:C2746AA4342C6AFFFBD174819440E1BBF4371A7FED29738801C75B49E2F4F94FD6D013E002BAD2AADAFBC477171B8332C8C5579D624684EF1AFBFDE9384B8588
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...`.@f.........." .........0...............................................@......K.....`A........................................p...l............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.7115212149950185
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:bWqhWUxWJWadJCsVWQ4mW5iFyttuX01k9z3A2EC:bWqhWUwCs8SR9zfEC
                                                                                                                                                                                                                                        MD5:321A3CA50E80795018D55A19BF799197
                                                                                                                                                                                                                                        SHA1:DF2D3C95FB4CBB298D255D342F204121D9D7EF7F
                                                                                                                                                                                                                                        SHA-256:5476DB3A4FECF532F96D48F9802C966FDEF98EC8D89978A79540CB4DB352C15F
                                                                                                                                                                                                                                        SHA-512:3EC20E1AC39A98CB5F726D8390C2EE3CD4CD0BF118FDDA7271F7604A4946D78778713B675D19DD3E1EC1D6D4D097ABE9CD6D0F76B3A7DFF53CE8D6DBC146870A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...j............" .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.893761152454321
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dEFP2WqhWVWEXCVWQ4mW68vx6RMySX01k9z3AzapOP:eF+WqhWi6gMR9zqa0
                                                                                                                                                                                                                                        MD5:0462E22F779295446CD0B63E61142CA5
                                                                                                                                                                                                                                        SHA1:616A325CD5B0971821571B880907CE1B181126AE
                                                                                                                                                                                                                                        SHA-256:0B6B598EC28A9E3D646F2BB37E1A57A3DDA069A55FBA86333727719585B1886E
                                                                                                                                                                                                                                        SHA-512:07B34DCA6B3078F7D1E8EDE5C639F697C71210DCF9F05212FD16EB181AB4AC62286BC4A7CE0D84832C17F5916D0224D1E8AAB210CEEFF811FC6724C8845A74FE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...L.Y..........." .........0...............................................@............`A........................................p...H............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):5.231196901820079
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:/Mck1JzX9cKSI0WqhWsWJWadJCsVWQ4mWClLeyttuX01k9z3A2XCJq:Uck1JzNcKSI0WqhWZCsvfSR9zfyk
                                                                                                                                                                                                                                        MD5:C3632083B312C184CBDD96551FED5519
                                                                                                                                                                                                                                        SHA1:A93E8E0AF42A144009727D2DECB337F963A9312E
                                                                                                                                                                                                                                        SHA-256:BE8D78978D81555554786E08CE474F6AF1DE96FCB7FA2F1CE4052BC80C6B2125
                                                                                                                                                                                                                                        SHA-512:8807C2444A044A3C02EF98CF56013285F07C4A1F7014200A21E20FCB995178BA835C30AC3889311E66BC61641D6226B1FF96331B019C83B6FCC7C87870CCE8C4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....O.j.........." .........0...............................................@......9&....`A........................................p................0...............0..x&..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.799245167892134
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:R0DfIeUWqhWLWJWadJCsVWQ4mWFVyttuX01k9z3A2YHmp:R0DfIeUWqhWiCsLSR9zfYHmp
                                                                                                                                                                                                                                        MD5:517EB9E2CB671AE49F99173D7F7CE43F
                                                                                                                                                                                                                                        SHA1:4CCF38FED56166DDBF0B7EFB4F5314C1F7D3B7AB
                                                                                                                                                                                                                                        SHA-256:57CC66BF0909C430364D35D92B64EB8B6A15DC201765403725FE323F39E8AC54
                                                                                                                                                                                                                                        SHA-512:492BE2445B10F6BFE6C561C1FC6F5D1AF6D1365B7449BC57A8F073B44AE49C88E66841F5C258B041547FCD33CBDCB4EB9DD3E24F0924DB32720E51651E9286BE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....#..........." .........0...............................................@.......,....`A........................................p................0...............0..x&..............p............................................................................rdata..\...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.587063911311469
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:fWqhWeWJWadJCsVWQ4mWMs7DENNVAv+cQ0GX01k9z3ARoIGA/:fWqhWbCs8oNbZR9zQoxS
                                                                                                                                                                                                                                        MD5:F3FF2D544F5CD9E66BFB8D170B661673
                                                                                                                                                                                                                                        SHA1:9E18107CFCD89F1BBB7FDAF65234C1DC8E614ADD
                                                                                                                                                                                                                                        SHA-256:E1C5D8984A674925FA4AFBFE58228BE5323FE5123ABCD17EC4160295875A625F
                                                                                                                                                                                                                                        SHA-512:184B09C77D079127580EF80EB34BDED0F5E874CEFBE1C5F851D86861E38967B995D859E8491FCC87508930DC06C6BBF02B649B3B489A1B138C51A7D4B4E7AAAD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......e.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..P...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.754374422741657
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:CGeVPWqhWUWJWadJCsVWQ4mWUhSqyttuX01k9z3A2lqn7cq:CGeVPWqhWBCsvoSR9zflBq
                                                                                                                                                                                                                                        MD5:A0C2DBE0F5E18D1ADD0D1BA22580893B
                                                                                                                                                                                                                                        SHA1:29624DF37151905467A223486500ED75617A1DFD
                                                                                                                                                                                                                                        SHA-256:3C29730DF2B28985A30D9C82092A1FAA0CEB7FFC1BD857D1EF6324CF5524802F
                                                                                                                                                                                                                                        SHA-512:3E627F111196009380D1687E024E6FFB1C0DCF4DCB27F8940F17FEC7EFDD8152FF365B43CB7FDB31DE300955D6C15E40A2C8FB6650A91706D7EA1C5D89319B12
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......Z.........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-string-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.664553499673792
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:mZyMvr5WqhWAWJWadJCsVWQ4mWWqpNVAv+cQ0GX01k9z3ARo+GZ:mZyMvlWqhWNCsUpNbZR9zQo+GZ
                                                                                                                                                                                                                                        MD5:2666581584BA60D48716420A6080ABDA
                                                                                                                                                                                                                                        SHA1:C103F0EA32EBBC50F4C494BCE7595F2B721CB5AD
                                                                                                                                                                                                                                        SHA-256:27E9D3E7C8756E4512932D674A738BF4C2969F834D65B2B79C342A22F662F328
                                                                                                                                                                                                                                        SHA-512:BEFED15F11A0550D2859094CC15526B791DADEA12C2E7CEB35916983FB7A100D89D638FB1704975464302FAE1E1A37F36E01E4BEF5BC4924AB8F3FD41E60BD0C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....I..........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..l...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):5.146069394118203
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:vUwidv3V0dfpkXc0vVaCsWqhWjCsa2IR9z5Bk5l:sHdv3VqpkXc0vVaP+U9zzk5l
                                                                                                                                                                                                                                        MD5:225D9F80F669CE452CA35E47AF94893F
                                                                                                                                                                                                                                        SHA1:37BD0FFC8E820247BD4DB1C36C3B9F9F686BBD50
                                                                                                                                                                                                                                        SHA-256:61C0EBE60CE6EBABCB927DDFF837A9BF17E14CD4B4C762AB709E630576EC7232
                                                                                                                                                                                                                                        SHA-512:2F71A3471A9868F4D026C01E4258AFF7192872590F5E5C66AABD3C088644D28629BA8835F3A4A23825631004B1AFD440EFE7161BB9FC7D7C69E0EE204813CA7B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....x.........." .........0...............................................@.......J....`A........................................p...X............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.834520503429805
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:etZ3xWqhWqWJWadJCsVWQ4mWfH/fKUSIX01k9z3AEXz40OY:etZ3xWqhWHCsMH2IR9z5OY
                                                                                                                                                                                                                                        MD5:1281E9D1750431D2FE3B480A8175D45C
                                                                                                                                                                                                                                        SHA1:BC982D1C750B88DCB4410739E057A86FF02D07EF
                                                                                                                                                                                                                                        SHA-256:433BD8DDC4F79AEE65CA94A54286D75E7D92B019853A883E51C2B938D2469BAA
                                                                                                                                                                                                                                        SHA-512:A954E6CE76F1375A8BEAC51D751B575BBC0B0B8BA6AA793402B26404E45718165199C2C00CCBCBA3783C16BDD96F0B2C17ADDCC619C39C8031BECEBEF428CE77
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@.......w....`A........................................p...x............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.916367637528538
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:qaIMFSYWqhWzWJWadJCsVWQ4mW14LyttuX01k9z3A2ClV:qdYWqhWqCsISR9zfCT
                                                                                                                                                                                                                                        MD5:FD46C3F6361E79B8616F56B22D935A53
                                                                                                                                                                                                                                        SHA1:107F488AD966633579D8EC5EB1919541F07532CE
                                                                                                                                                                                                                                        SHA-256:0DC92E8830BC84337DCAE19EF03A84EF5279CF7D4FDC2442C1BC25320369F9DF
                                                                                                                                                                                                                                        SHA-512:3360B2E2A25D545CCD969F305C4668C6CDA443BBDBD8A8356FFE9FBC2F70D90CF4540F2F28C9ED3EEA6C9074F94E69746E7705E6254827E6A4F158A75D81065B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...~.l-.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.829681745003914
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:HNpWqhW5WJWadJCsVWQ4mWbZyttuX01k9z3A2qkFU:HXWqhW4Cs1SR9zf9U
                                                                                                                                                                                                                                        MD5:D12403EE11359259BA2B0706E5E5111C
                                                                                                                                                                                                                                        SHA1:03CC7827A30FD1DEE38665C0CC993B4B533AC138
                                                                                                                                                                                                                                        SHA-256:F60E1751A6AC41F08E46480BF8E6521B41E2E427803996B32BDC5E78E9560781
                                                                                                                                                                                                                                        SHA-512:9004F4E59835AF57F02E8D9625814DB56F0E4A98467041DA6F1367EF32366AD96E0338D48FFF7CC65839A24148E2D9989883BCDDC329D9F4D27CAE3F843117D0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...>.os.........." .........0...............................................@............`A........................................p...H............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-core-util-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.612408827336625
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:CWqhW+WJWadJCsVWQ4mWprgfKUSIX01k9z3AEXzh:CWqhW7Cs12IR9z5F
                                                                                                                                                                                                                                        MD5:0F129611A4F1E7752F3671C9AA6EA736
                                                                                                                                                                                                                                        SHA1:40C07A94045B17DAE8A02C1D2B49301FAD231152
                                                                                                                                                                                                                                        SHA-256:2E1F090ABA941B9D2D503E4CD735C958DF7BB68F1E9BDC3F47692E1571AAAC2F
                                                                                                                                                                                                                                        SHA-512:6ABC0F4878BB302713755A188F662C6FE162EA6267E5E1C497C9BA9FDDBDAEA4DB050E322CB1C77D6638ECF1DAD940B9EBC92C43ACAA594040EE58D313CBCFAE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....+..........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.918215004381039
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:OvMWqhWkWJWadJCsVWQ4mWoz/HyttuX01k9z3A21O:JWqhWxCs/SSR9zf1O
                                                                                                                                                                                                                                        MD5:D4FBA5A92D68916EC17104E09D1D9D12
                                                                                                                                                                                                                                        SHA1:247DBC625B72FFB0BF546B17FB4DE10CAD38D495
                                                                                                                                                                                                                                        SHA-256:93619259328A264287AEE7C5B88F7F0EE32425D7323CE5DC5A2EF4FE3BED90D5
                                                                                                                                                                                                                                        SHA-512:D5A535F881C09F37E0ADF3B58D41E123F527D081A1EBECD9A927664582AE268341771728DC967C30908E502B49F6F853EEAEBB56580B947A629EDC6BCE2340D8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Aj............" .........0...............................................@......UJ....`A.........................................................0...............0..x&..............p............................................................................rdata..p...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26216
                                                                                                                                                                                                                                        Entropy (8bit):4.882777558752248
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:I9cy5WqhWKWEXCVWQ4mW1pbm6yttuX01k9z3A2jyM:Ry5WqhWdcbmLSR9zfjj
                                                                                                                                                                                                                                        MD5:EDF71C5C232F5F6EF3849450F2100B54
                                                                                                                                                                                                                                        SHA1:ED46DA7D59811B566DD438FA1D09C20F5DC493CE
                                                                                                                                                                                                                                        SHA-256:B987AB40CDD950EBE7A9A9176B80B8FFFC005CCD370BB1CBBCAD078C1A506BDC
                                                                                                                                                                                                                                        SHA-512:481A3C8DC5BEF793EE78CE85EC0F193E3E9F6CD57868B813965B312BD0FADEB5F4419707CD3004FBDB407652101D52E061EF84317E8BD458979443E9F8E4079A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...U.gJ.........." .........@...............................................P............`A.........................................................@...............@..h&..............p............................................................................rdata..n........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.738587310329139
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:TWqhWXWEXCVWQ4mWPXTNyttuX01k9z3A2dGxr:TWqhWMKASR9zfYxr
                                                                                                                                                                                                                                        MD5:F9235935DD3BA2AA66D3AA3412ACCFBF
                                                                                                                                                                                                                                        SHA1:281E548B526411BCB3813EB98462F48FFAF4B3EB
                                                                                                                                                                                                                                        SHA-256:2F6BD6C235E044755D5707BD560A6AFC0BA712437530F76D11079D67C0CF3200
                                                                                                                                                                                                                                        SHA-512:AD0C0A7891FB8328F6F0CF1DDC97523A317D727C15D15498AFA53C07610210D2610DB4BC9BD25958D47ADC1AF829AD4D7CF8AABCAB3625C783177CCDB7714246
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...9.4o.........." .........0...............................................@......h*....`A............................................"............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):5.202163846121633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:2pUEpnWlC0i5CBWqhWXLeWEXCVWQ4iW+/x6RMySX01k9z3Aza8Az629:2ptnWm5CBWqhWtWMR9zqaH629
                                                                                                                                                                                                                                        MD5:5107487B726BDCC7B9F7E4C2FF7F907C
                                                                                                                                                                                                                                        SHA1:EBC46221D3C81A409FAB9815C4215AD5DA62449C
                                                                                                                                                                                                                                        SHA-256:94A86E28E829276974E01F8A15787FDE6ED699C8B9DC26F16A51765C86C3EADE
                                                                                                                                                                                                                                        SHA-512:A0009B80AD6A928580F2B476C1BDF4352B0611BB3A180418F2A42CFA7A03B9F0575ED75EC855D30B26E0CCA96A6DA8AFFB54862B6B9AFF33710D2F3129283FAA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......M4....`A.........................................................0...............0..h&..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.866983142029453
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:0vh8Y17aFBRsWqhW9AWEXCVWQ4mWCB4Lrp0KBQfX01k9z3ALkg5Z7:SL5WqhW9boRxB+R9z2kM7
                                                                                                                                                                                                                                        MD5:D5D77669BD8D382EC474BE0608AFD03F
                                                                                                                                                                                                                                        SHA1:1558F5A0F5FACC79D3957FF1E72A608766E11A64
                                                                                                                                                                                                                                        SHA-256:8DD9218998B4C4C9E8D8B0F8B9611D49419B3C80DAA2F437CBF15BCFD4C0B3B8
                                                                                                                                                                                                                                        SHA-512:8DEFA71772105FD9128A669F6FF19B6FE47745A0305BEB9A8CADB672ED087077F7538CD56E39329F7DAA37797A96469EAE7CD5E4CCA57C9A183B35BDC44182F3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...."]..........." .........0...............................................@............`A.........................................................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.828044267819929
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dUnWqhWRWJWadJCsVWQ4mW+2PyttuX01k9z3A23y:cWqhWQCsHSR9zf3y
                                                                                                                                                                                                                                        MD5:650435E39D38160ABC3973514D6C6640
                                                                                                                                                                                                                                        SHA1:9A5591C29E4D91EAA0F12AD603AF05BB49708A2D
                                                                                                                                                                                                                                        SHA-256:551A34C400522957063A2D71FA5ABA1CD78CC4F61F0ACE1CD42CC72118C500C0
                                                                                                                                                                                                                                        SHA-512:7B4A8F86D583562956593D27B7ECB695CB24AB7192A94361F994FADBA7A488375217755E7ED5071DE1D0960F60F255AA305E9DD477C38B7BB70AC545082C9D5E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...6..q.........." .........0...............................................@.......-....`A............................................e............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):30328
                                                                                                                                                                                                                                        Entropy (8bit):5.14173409150951
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:r7yaFM4Oe59Ckb1hgmLVWqhW2CsWNbZR9zQoekS:/FMq59Bb1jnoFT9zGp
                                                                                                                                                                                                                                        MD5:B8F0210C47847FC6EC9FBE2A1AD4DEBB
                                                                                                                                                                                                                                        SHA1:E99D833AE730BE1FEDC826BF1569C26F30DA0D17
                                                                                                                                                                                                                                        SHA-256:1C4A70A73096B64B536BE8132ED402BCFB182C01B8A451BFF452EFE36DDF76E7
                                                                                                                                                                                                                                        SHA-512:992D790E18AC7AE33958F53D458D15BFF522A3C11A6BD7EE2F784AC16399DE8B9F0A7EE896D9F2C96D1E2C8829B2F35FF11FC5D8D1B14C77E22D859A1387797C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................" .........P...............................................`............`A.............................................%...........P...............P..x&..............p............................................................................rdata...'.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-multibyte-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):30312
                                                                                                                                                                                                                                        Entropy (8bit):4.96699982894665
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:PfhhvLPmIHJI6/CpG3t2G3t4odXLVWqhW2ntNbZR9zQo9eZ:xhPmIHJI69VFT9zO
                                                                                                                                                                                                                                        MD5:075419431D46DC67932B04A8B91A772F
                                                                                                                                                                                                                                        SHA1:DB2AF49EE7B6BEC379499B5A80BE39310C6C8425
                                                                                                                                                                                                                                        SHA-256:3A4B66E65A5EE311AFC37157A8101ABA6017FF7A4355B4DD6E6C71D5B7223560
                                                                                                                                                                                                                                        SHA-512:76287E0003A396CDA84CE6B206986476F85E927A389787D1D273684167327C41FC0FE5E947175C0DEB382C5ACCF785F867D9FCE1FEA4ABD7D99B201E277D1704
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Y.g..........." .........P...............................................`.......r....`A............................................. ...........P...............P..h&..............p............................................................................rdata..t".......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-process-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.883012715268179
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5eXrqjd7ZWqhW3WEXCVWQ4mW3Ql1Lrp0KBQfX01k9z3ALkjY/12:54rgWqhWsP1RxB+R9z2kjY/Y
                                                                                                                                                                                                                                        MD5:272C0F80FD132E434CDCDD4E184BB1D8
                                                                                                                                                                                                                                        SHA1:5BC8B7260E690B4D4039FE27B48B2CECEC39652F
                                                                                                                                                                                                                                        SHA-256:BD943767F3E0568E19FB52522217C22B6627B66A3B71CD38DD6653B50662F39D
                                                                                                                                                                                                                                        SHA-512:94892A934A92EF1630FBFEA956D1FE3A3BFE687DEC31092828960968CB321C4AB3AF3CAF191D4E28C8CA6B8927FBC1EC5D17D5C8A962C848F4373602EC982CD4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...<SdT.........." .........0...............................................@......N.....`A............................................x............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-runtime-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26208
                                                                                                                                                                                                                                        Entropy (8bit):5.023753175006074
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:4mGqX8mPrpJhhf4AN5/KiFWqhWyzWEXCVWQ4OW4034hHssDX01k9z3AaYX2cWo:4ysyr77WqhWyI0oFDR9z9YH9
                                                                                                                                                                                                                                        MD5:20C0AFA78836B3F0B692C22F12BDA70A
                                                                                                                                                                                                                                        SHA1:60BB74615A71BD6B489C500E6E69722F357D283E
                                                                                                                                                                                                                                        SHA-256:962D725D089F140482EE9A8FF57F440A513387DD03FDC06B3A28562C8090C0BC
                                                                                                                                                                                                                                        SHA-512:65F0E60136AB358661E5156B8ECD135182C8AAEFD3EC320ABDF9CFC8AEAB7B68581890E0BBC56BAD858B83D47B7A0143FA791195101DC3E2D78956F591641D16
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....TR.........." .........@...............................................P......D!....`A............................................4............@...............@..`&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-stdio-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26232
                                                                                                                                                                                                                                        Entropy (8bit):5.289041983400337
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:UuV2OlkuWYFxEpahfWqhWNWJWadJCsVWQ4mWeX9UfKUSIX01k9z3AEXzGd5S:dV2oFVhfWqhWMCstE2IR9z5Sd5S
                                                                                                                                                                                                                                        MD5:96498DC4C2C879055A7AFF2A1CC2451E
                                                                                                                                                                                                                                        SHA1:FECBC0F854B1ADF49EF07BEACAD3CEC9358B4FB2
                                                                                                                                                                                                                                        SHA-256:273817A137EE049CBD8E51DC0BB1C7987DF7E3BF4968940EE35376F87EF2EF8D
                                                                                                                                                                                                                                        SHA-512:4E0B2EF0EFE81A8289A447EB48898992692FEEE4739CEB9D87F5598E449E0059B4E6F4EB19794B9DCDCE78C05C8871264797C14E4754FD73280F37EC3EA3C304
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...k. U.........." .........@...............................................P............`A............................................a............@...............@..x&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26232
                                                                                                                                                                                                                                        Entropy (8bit):5.284932479906984
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:tCLx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWqhWbQCsMSR9zful:tCV5yguNvZ5VQgx3SbwA71IkFGqHe9zI
                                                                                                                                                                                                                                        MD5:115E8275EB570B02E72C0C8A156970B3
                                                                                                                                                                                                                                        SHA1:C305868A014D8D7BBEF9ABBB1C49A70E8511D5A6
                                                                                                                                                                                                                                        SHA-256:415025DCE5A086DBFFC4CF322E8EAD55CB45F6D946801F6F5193DF044DB2F004
                                                                                                                                                                                                                                        SHA-512:B97EF7C5203A0105386E4949445350D8FF1C83BDEAEE71CCF8DC22F7F6D4F113CB0A9BE136717895C36EE8455778549F629BF8D8364109185C0BF28F3CB2B2CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.... .h.........." .........@...............................................P......\.....`A.........................................................@...............@..x&..............p............................................................................rdata.._........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-time-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):5.253102285412285
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:mt3hwDGWqhWrWEXCVWQ4mWn+deyttuX01k9z3A23x:AWqhWgPSR9zfh
                                                                                                                                                                                                                                        MD5:001E60F6BBF255A60A5EA542E6339706
                                                                                                                                                                                                                                        SHA1:F9172EC37921432D5031758D0C644FE78CDB25FA
                                                                                                                                                                                                                                        SHA-256:82FBA9BC21F77309A649EDC8E6FC1900F37E3FFCB45CD61E65E23840C505B945
                                                                                                                                                                                                                                        SHA-512:B1A6DC5A34968FBDC8147D8403ADF8B800A06771CC9F15613F5CE874C29259A156BAB875AAE4CAAEC2117817CE79682A268AA6E037546AECA664CD4EEA60ADBF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...G............" .........0...............................................@.......&....`A.........................................................0...............0..h&..............p............................................................................rdata..=...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\api-ms-win-crt-utility-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.810971823417463
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:p/fHQduDWqhWJWJWadJCsVWQ4mWxrnyttuX01k9z3A2Yv6WT:p/ftWqhWoCsmySR9zfYvvT
                                                                                                                                                                                                                                        MD5:A0776B3A28F7246B4A24FF1B2867BDBF
                                                                                                                                                                                                                                        SHA1:383C9A6AFDA7C1E855E25055AAD00E92F9D6AAFF
                                                                                                                                                                                                                                        SHA-256:2E554D9BF872A64D2CD0F0EB9D5A06DEA78548BC0C7A6F76E0A0C8C069F3C0A9
                                                                                                                                                                                                                                        SHA-512:7C9F0F8E53B363EF5B2E56EEC95E7B78EC50E9308F34974A287784A1C69C9106F49EA2D9CA037F0A7B3C57620FCBB1C7C372F207C68167DF85797AFFC3D7F3BA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......^.....`A............................................^............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\attrs-24.2.0.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\attrs-24.2.0.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:Unicode text, UTF-8 text, with very long lines (411)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11524
                                                                                                                                                                                                                                        Entropy (8bit):5.211520136058075
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ERsUfi6bkQk+k/kKkegToJWicnJsPVA1oz2dv7COmoKTACoEJdQ/0G6lWg+JdQV5:ERsXpLs3VoJWRnJsPvz2dDCHoKsLgA6z
                                                                                                                                                                                                                                        MD5:49CABCB5F8DA14C72C8C3D00ADB3C115
                                                                                                                                                                                                                                        SHA1:F575BECF993ECDF9C6E43190C1CB74D3556CF912
                                                                                                                                                                                                                                        SHA-256:DC9824E25AFD635480A8073038B3CDFE6A56D3073A54E1A6FB21EDD4BB0F207C
                                                                                                                                                                                                                                        SHA-512:923DAEEE0861611D230DF263577B3C382AE26400CA5F1830EE309BD6737EED2AD934010D61CDD4796618BEDB3436CD772D9429A5BED0A106EF7DE60E114E505C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.3.Name: attrs.Version: 24.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\attrs-24.2.0.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3556
                                                                                                                                                                                                                                        Entropy (8bit):5.810477636970161
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:Q9ewrFmJT/oPynEddwBbCobXm9qGmR5VXzskCGD+qLtxO:2ewBoJCKXGeR/XzIiO
                                                                                                                                                                                                                                        MD5:8037E693EAFED6C3D0CCE916BABB50C4
                                                                                                                                                                                                                                        SHA1:2321392AAB7AE3A6A78248E5D5F454124D368EC1
                                                                                                                                                                                                                                        SHA-256:688073F6556808D9139FEA52BEC3802D8C0D7CE07978B98AAE8DB5C98FACC0DF
                                                                                                                                                                                                                                        SHA-512:95B9E6B8F946D2617098C338441AFC5A555FF208947D5731E09EE17B959655161C397F57E14827A95A8FD4554DE8C6E426DC316F858510AE4AA7CA8723C4CF51
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:attr/__init__.py,sha256=l8Ewh5KZE7CCY0i1iDfSCnFiUTIkBVoqsXjX9EZnIVA,2087..attr/__init__.pyi,sha256=aTVHBPX6krCGvbQvOl_UKqEzmi2HFsaIVm2WKmAiqVs,11434..attr/__pycache__/__init__.cpython-311.pyc,,..attr/__pycache__/_cmp.cpython-311.pyc,,..attr/__pycache__/_compat.cpython-311.pyc,,..attr/__pycache__/_config.cpython-311.pyc,,..attr/__pycache__/_funcs.cpython-311.pyc,,..attr/__pycache__/_make.cpython-311.pyc,,..attr/__pycache__/_next_gen.cpython-311.pyc,,..attr/__pycache__/_version_info.cpython-311.pyc,,..attr/__pycache__/converters.cpython-311.pyc,,..attr/__pycache__/exceptions.cpython-311.pyc,,..attr/__pycache__/filters.cpython-311.pyc,,..attr/__pycache__/setters.cpython-311.pyc,,..attr/__pycache__/validators.cpython-311.pyc,,..attr/_cmp.py,sha256=3umHiBtgsEYtvNP_8XrQwTCdFoZIX4DEur76N-2a3X8,4123..attr/_cmp.pyi,sha256=U-_RU_UZOyPUEQzXE6RMYQQcjkZRY25wTH99sN0s7MM,368..attr/_compat.py,sha256=n2Uk3c-ywv0PkFfGlvqR7SzDXp4NOhWmNV_ZK6YfWoM,2958..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\attrs-24.2.0.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):87
                                                                                                                                                                                                                                        Entropy (8bit):4.730668933656452
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeXAaCTQnP+tPCCfA5I:Rt2PcnWBB3
                                                                                                                                                                                                                                        MD5:52ADFA0C417902EE8F0C3D1CA2372AC3
                                                                                                                                                                                                                                        SHA1:B67635615EEF7E869D74F4813B5DC576104825DD
                                                                                                                                                                                                                                        SHA-256:D7215D7625CC9AF60AED0613AAD44DB57EBA589D0CCFC3D8122114A0E514C516
                                                                                                                                                                                                                                        SHA-512:BFA87E7B0E76E544C2108EF40B9FAC8C5FF4327AB8EDE9FEB2891BD5D38FEA117BD9EEBAF62F6C357B4DEADDAD5A5220E0B4A54078C8C2DE34CB1DD5E00F2D62
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: hatchling 1.25.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\attrs-24.2.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1109
                                                                                                                                                                                                                                        Entropy (8bit):5.104415762129373
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                                                        MD5:5E55731824CF9205CFABEAB9A0600887
                                                                                                                                                                                                                                        SHA1:243E9DD038D3D68C67D42C0C4BA80622C2A56246
                                                                                                                                                                                                                                        SHA-256:882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
                                                                                                                                                                                                                                        SHA-512:21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\base_library.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1440734
                                                                                                                                                                                                                                        Entropy (8bit):5.590363711484859
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:mQR5pATG8/R5lUKdcubgAnyfb8hd0iwhJdYf9PyetHHA:mQR5pE/RbVc
                                                                                                                                                                                                                                        MD5:34A1E9C9033D4DBEC9AA8FCE5CF8403F
                                                                                                                                                                                                                                        SHA1:B6379C9E683CF1B304F5027CF42040892799F377
                                                                                                                                                                                                                                        SHA-256:4C21ADBCC2A8D8ADC1D4B693017C6276B03CB505BB810F46709D75AC3FB77668
                                                                                                                                                                                                                                        SHA-512:CEDC5735ECF29A50BADE26040C39B5511E18E6D0A921B05E51EF1C1391B64C43F6D0944DE51E88FAD5A62DB8391C80FBE2D9673FB524F92EA0DBD55E659AC3D6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\certifi\cacert.pem

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):299427
                                                                                                                                                                                                                                        Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                        MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                        SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                        SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                        SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\charset_normalizer\md.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.8208567868970675
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:Y0fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFuCQAAZWQcX6g8H4a81:gFCk2z1/t12iwU5usJFKCyHcqgg
                                                                                                                                                                                                                                        MD5:CBF62E25E6E036D3AB1946DBAFF114C1
                                                                                                                                                                                                                                        SHA1:B35F91EAF4627311B56707EF12E05D6D435A4248
                                                                                                                                                                                                                                        SHA-256:06032E64E1561251EA3035112785F43945B1E959A9BF586C35C9EA1C59585C37
                                                                                                                                                                                                                                        SHA-512:04B694D0AE99D5786FA19F03C5B4DD8124C4F9144CFE7CA250B48A3C0DE0883E06A6319351AE93EA95B55BBBFA69525A91E9407478E40AD62951F1D63D45FF18
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................X......o..............o.......o.......o......j..............n......n......n4.....n......Rich....................PE..d....#.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):121344
                                                                                                                                                                                                                                        Entropy (8bit):5.899699901799497
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:3Ives1m094QtwqlaZTwuQMS/Pf+vGTVmEU:3PsQIJmE
                                                                                                                                                                                                                                        MD5:BAC273806F46CFFB94A84D7B4CED6027
                                                                                                                                                                                                                                        SHA1:773FBC0435196C8123EE89B0A2FC4D44241FF063
                                                                                                                                                                                                                                        SHA-256:1D9ABA3FF1156EA1FBE10B8AA201D4565AE6022DAF2117390D1D8197B80BB70B
                                                                                                                                                                                                                                        SHA-512:EAEC1F072C2C0BC439AC7B4E3AEA6E75C07BD4CD2D653BE8500BBFFE371FBFE045227DAEAD653C162D972CCAADFF18AC7DA4D366D1200618B0291D76E18B125C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yB............................................................................................Rich...........................PE..d....#.g.........." ...).2..........@4.......................................0............`.............................................d...d...................p............ ......@...................................@............P...............................text...x0.......2.................. ..`.rdata...Y...P...Z...6..............@..@.data....=.......0..................@....pdata..p...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5440
                                                                                                                                                                                                                                        Entropy (8bit):5.074230645519915
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
                                                                                                                                                                                                                                        MD5:C891CD93024AF027647E6DE89D0FFCE2
                                                                                                                                                                                                                                        SHA1:01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
                                                                                                                                                                                                                                        SHA-256:EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
                                                                                                                                                                                                                                        SHA-512:3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15485
                                                                                                                                                                                                                                        Entropy (8bit):5.562409393703148
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:1XxTBjWz5jF4ELZVhXau4WPE6FGotqw++NX6in55qw/n+B:1XXjWhCEJaiPE6FGotqw++96in5+B
                                                                                                                                                                                                                                        MD5:13F4AAA0BE473C30F1FCFE7C1E5CC75C
                                                                                                                                                                                                                                        SHA1:D542DDD6490DE41A96F53579F021EE633B32A4AA
                                                                                                                                                                                                                                        SHA-256:5AC071DBE59CB47B67628486C36D8E477CB152A2120147B94197EA5142EC3804
                                                                                                                                                                                                                                        SHA-512:E4E19893A650F91706A472875C398D014AB103D55D065F3D6E9E3AF24AE8D12B87D61C1D1C9C040819E1B9F19A88850780DBA1ED49D380A6273D164169013040
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-311.pyc,,..cryptography/__pycache__/__init__.cpython-311.pyc,,..cryptography/__pycache__/exceptions.cpython-311.pyc,,..cryptography/__p

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):94
                                                                                                                                                                                                                                        Entropy (8bit):5.016084900984752
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
                                                                                                                                                                                                                                        MD5:C869D30012A100ADEB75860F3810C8C9
                                                                                                                                                                                                                                        SHA1:42FD5CFA75566E8A9525E087A2018E8666ED22CB
                                                                                                                                                                                                                                        SHA-256:F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
                                                                                                                                                                                                                                        SHA-512:B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info\license_files\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):197
                                                                                                                                                                                                                                        Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                                        MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                                        SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                                        SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                                        SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11360
                                                                                                                                                                                                                                        Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                                        MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                                        SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                                        SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                                        SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1532
                                                                                                                                                                                                                                        Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                                        MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                                        SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                                        SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                                        SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7834624
                                                                                                                                                                                                                                        Entropy (8bit):6.517862303223651
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
                                                                                                                                                                                                                                        MD5:BFD28B03A4C32A9BCB001451FD002F67
                                                                                                                                                                                                                                        SHA1:DD528FD5F4775E16B2E743D3188B66F1174807B2
                                                                                                                                                                                                                                        SHA-256:8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
                                                                                                                                                                                                                                        SHA-512:6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\frozenlist\_frozenlist.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):87040
                                                                                                                                                                                                                                        Entropy (8bit):5.923038424678
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:qundZwmaApD60dSpyT4DIk54S85QwvpC/vNZAg:nLwUpzAczh+wvpqvNZP
                                                                                                                                                                                                                                        MD5:E8CADECD9A3684DBA357FC0489C62492
                                                                                                                                                                                                                                        SHA1:4C488D097A85F9BC61F842E3DCF42E228B9885B3
                                                                                                                                                                                                                                        SHA-256:02053F53EB078BE1488735878DC68524F0E103342250A09EECAE3533D8E9C770
                                                                                                                                                                                                                                        SHA-512:2443C90931A9AD672938D13C60FDB564EE8AA9FCA85E0426445CE36C395AC9675B6F6488518FF16071731CF8E9A0C2F8DD3182120FD9A7DAF6FD2EE813D2C781
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.5...f...f...f.dDf...f...g...f.d.g...f...g...f...g...f...g...f..g...f...f2..f..g...f..g...f.(f...f..g...fRich...f................PE..d......g.........." ...).....v............................................................`.........................................`7..h....7..x............p..X....................&..............................`%..@...............@............................text............................... ..`.rdata...J.......L..................@..@.data........P.......6..............@....pdata..X....p.......D..............@..@.rsrc................P..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\libcrypto-3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5162776
                                                                                                                                                                                                                                        Entropy (8bit):5.958207976652471
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
                                                                                                                                                                                                                                        MD5:51E8A5281C2092E45D8C97FBDBF39560
                                                                                                                                                                                                                                        SHA1:C499C810ED83AAADCE3B267807E593EC6B121211
                                                                                                                                                                                                                                        SHA-256:2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
                                                                                                                                                                                                                                        SHA-512:98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\libffi-8.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):39696
                                                                                                                                                                                                                                        Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                        MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                        SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                        SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                        SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\libssl-3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):790296
                                                                                                                                                                                                                                        Entropy (8bit):5.607732992846443
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
                                                                                                                                                                                                                                        MD5:BFC834BB2310DDF01BE9AD9CFF7C2A41
                                                                                                                                                                                                                                        SHA1:FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
                                                                                                                                                                                                                                        SHA-256:41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
                                                                                                                                                                                                                                        SHA-512:6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\lz4-4.3.3.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\lz4-4.3.3.dist-info\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1523
                                                                                                                                                                                                                                        Entropy (8bit):5.162397061365918
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:oY3UnzobbOmFTVJcFTzA6GLQrBTP49H432sZEOkHs8nRO632smyxtTfr10VZlQfS:ROmJIJzSEP6H432smp32smEtP10VwHy
                                                                                                                                                                                                                                        MD5:2F7382E069BEAC97D607124540FD5661
                                                                                                                                                                                                                                        SHA1:1684541BA4AF5542BA7E6490C25882CA125A1C47
                                                                                                                                                                                                                                        SHA-256:A7D65D1DD4DCC86DCA5D17D46AA4A1C77669C9B72F55F298E9E2212F2905C0CF
                                                                                                                                                                                                                                        SHA-512:4BD08A47B9B67098E38895E96136B3A5EE4711DEF8EB6AC87B522F2A024FC7F22EA4B53E048C2BB3F636EA81CD0814B53B4E20361EBC1A8CDE1C8E57F7A76089
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright (c) 2012-2013, Steeve Morin..All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions are met:....1. Redistributions of source code must retain the above copyright notice,.. this list of conditions and the following disclaimer.....2. Redistributions in binary form must reproduce the above copyright notice,.. this list of conditions and the following disclaimer in the documentation.. and/or other materials provided with the distribution.....3. Neither the name of Steeve Morin nor the names of its contributors may be.. used to endorse or promote products derived from this software without.. specific prior written permission.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"..AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE..IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE..ARE DISCLAIMED.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\lz4-4.3.3.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3758
                                                                                                                                                                                                                                        Entropy (8bit):5.092767270997029
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:DdPHo8lGovhSaWMqCBAInB8fhfxF914CAXTzbIYB/HF4s1LWlAjC:tHoczVBAu6fhft15AzjlLLC
                                                                                                                                                                                                                                        MD5:3D855AD86A99255B3248D88C524148FC
                                                                                                                                                                                                                                        SHA1:1ADBA31F74CC4BA33AD9AE31EE29CABA66EB4D93
                                                                                                                                                                                                                                        SHA-256:612E3D4394DFDCA3E93C74FF02ABC012757279F7BA879D875BEE58F643A45FFE
                                                                                                                                                                                                                                        SHA-512:99E0C5E2DD734CBB653FDFC80C8F568EEEFAAAEF83BA92431DCE97770077759A0550FA6FC58EC3F86C67774CA9F02C0EC33164B4471DB2D659202979C868A4EF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.1..Name: lz4..Version: 4.3.3..Summary: LZ4 Bindings for Python..Home-page: https://github.com/python-lz4/python-lz4..Author: Jonathan Underwood..Author-email: jonathan.underwood@gmail.com..Classifier: Development Status :: 5 - Production/Stable..Classifier: License :: OSI Approved :: BSD License..Classifier: Intended Audience :: Developers..Classifier: Programming Language :: C..Classifier: Programming Language :: Python..Classifier: Programming Language :: Python :: 3.8..Classifier: Programming Language :: Python :: 3.9..Classifier: Programming Language :: Python :: 3.10..Classifier: Programming Language :: Python :: 3.11..Classifier: Programming Language :: Python :: 3.12..Requires-Python: >=3.8..License-File: LICENSE..Provides-Extra: docs..Requires-Dist: sphinx >=1.6.0 ; extra == 'docs'..Requires-Dist: sphinx-bootstrap-theme ; extra == 'docs'..Provides-Extra: flake8..Requires-Dist: flake8 ; extra == 'flake8'..Provides-Extra: tests..Requires-Dist: pytest !=3.3.0 ;

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\lz4-4.3.3.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1224
                                                                                                                                                                                                                                        Entropy (8bit):5.865132521742272
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:on/2zDBvNGAt5OjUyWolSl1xp++ihiB5YJ+SdX54nhOZH58lFc:onuXBZqjUhocllkiHYA+54nYZH5iFc
                                                                                                                                                                                                                                        MD5:5767B79313C4C7634B59A06B711F4A2F
                                                                                                                                                                                                                                        SHA1:906B83790268C9042874E5E05DC7C0CF57106E1C
                                                                                                                                                                                                                                        SHA-256:BB6AB4126ED02B0B83CC89FCF371C9D5F4BC927DE87632245007569ED49F6D3D
                                                                                                                                                                                                                                        SHA-512:8B93C1D32CD84AAC9B0E5358B84A498C524FD45E365CE088AA3A8A0D8D1B4916B053A1628BAE63111C13AFFFD367CF5AFA3437106F83968B11F34E9A1E5D8BB6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:lz4-4.3.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..lz4-4.3.3.dist-info/LICENSE,sha256=p9ZdHdTcyG3KXRfUaqShx3ZpybcvVfKY6eIhLykFwM8,1523..lz4-4.3.3.dist-info/METADATA,sha256=YS49Q5Tf3KPpPHT_AqvAEnVyefe6h52HW-5Y9kOkX_4,3758..lz4-4.3.3.dist-info/RECORD,,..lz4-4.3.3.dist-info/WHEEL,sha256=ircjsfhzblqgSzO8ow7-0pXK-RVqDqNRGQ8F650AUNM,102..lz4-4.3.3.dist-info/top_level.txt,sha256=cX6_gxFUdNSo40TfxrGpTCgu7epGm3yW3m2k7irTDzI,4..lz4/__init__.py,sha256=e_8j-K4TJx38qcPNjoZP_pNDo8IpE4D2ZWl4p50iV_8,646..lz4/__pycache__/__init__.cpython-311.pyc,,..lz4/__pycache__/version.cpython-311.pyc,,..lz4/_version.cp311-win_amd64.pyd,sha256=BXu927P5cO4vjggWtfvZIvPt6wgmoQUK9Cd_j9ngmks,11264..lz4/block/__init__.py,sha256=DSUbS7zMlKKeLs8JO9riOBO5Q_lVoSB-nwgjfhBeXt0,71..lz4/block/__pycache__/__init__.cpython-311.pyc,,..lz4/block/_block.cp311-win_amd64.pyd,sha256=N8neJ86OtjJrV98ODkd4GPyX1va57JBvAp6OU41xM9c,76800..lz4/frame/__init__.py,sha256=ZnJ4sJ1HStPpmJpo0q_CGm9fDEui3Tt3V8DmMi68SZM,

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\lz4-4.3.3.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):102
                                                                                                                                                                                                                                        Entropy (8bit):5.0254896858991245
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeX7MWcSlVlbY3KgP+tkKcfxLQLn:RtBMwlVCxWK5NQLn
                                                                                                                                                                                                                                        MD5:4F7020292A2B5B7F3BCC9B1F5B5AFEB4
                                                                                                                                                                                                                                        SHA1:D2C2D48CCB76629F7604B9881357F129D76F635F
                                                                                                                                                                                                                                        SHA-256:8AB723B1F8736E5AA04B33BCA30EFED295CAF9156A0EA351190F05EB9D0050D3
                                                                                                                                                                                                                                        SHA-512:4D7598EEC10105C1826732DC78FC89850A7343B733A5441DDB53606F8BA7A15C8F058C6C9C0C0EE99951B383BB30C94279FDCE7F0E588A70367DC46D3C672E20
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp311-cp311-win_amd64..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\lz4-4.3.3.dist-info\top_level.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):2.0
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:fn:f
                                                                                                                                                                                                                                        MD5:194B36A8466E4650490040D599B09C0E
                                                                                                                                                                                                                                        SHA1:4CB4A2C46E9892B8A712716F9B42537D1962BBB4
                                                                                                                                                                                                                                        SHA-256:717EBF83115474D4A8E344DFC6B1A94C282EEDEA469B7C96DE6DA4EE2AD30F32
                                                                                                                                                                                                                                        SHA-512:C55B2D3D46EC558533B4019DFFA87B1F93E7866DBCDE8D00243D8C54F1A3094933256BD25EAA0333D6EC4B308F1A4C92630BBEF6E10BE7892774DCCF5556FE77
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:lz4.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\lz4\_version.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11264
                                                                                                                                                                                                                                        Entropy (8bit):4.696226726378701
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:VkW+7TRSsA2zVJoYeEw0VTmrgJyUCN5XsMtEZqfH/OZYUo8/NcX6gZYPV:KHRSsvZJ5YNRZEZqn0YUHNcqg4
                                                                                                                                                                                                                                        MD5:44229B69D9EE7308DA5D880081A1CB75
                                                                                                                                                                                                                                        SHA1:AEF85718A2658629A7FB399E3D4AED0001409182
                                                                                                                                                                                                                                        SHA-256:057BBDDBB3F970EE2F8E0816B5FBD922F3EDEB0826A1050AF4277F8FD9E09A4B
                                                                                                                                                                                                                                        SHA-512:0622A64DA707BCF8EE5E2EA48EFACC3EBB70A4DB16F50DD26DD407AAFC178D0AB443651F38B67B1423C4024E5C1D339509049FB0D2C759659AB980B92D8F9F66
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y7..8Y..8Y..8Y..@...8Y..GX..8Y.@X..8Y..G\..8Y..G]..8Y..GZ..8Y.7EX..8Y..8X..8Y..Q..8Y..Y..8Y.....8Y..[..8Y.Rich.8Y.........................PE..d....@.e.........." ...%.....................................................p............`.........................................p*..`....*..d....P.......@...............`..D...p%..............................0$..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..D....`.......*..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\lz4\block\_block.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):76800
                                                                                                                                                                                                                                        Entropy (8bit):6.201674022552313
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:+V4xVkjuE0OoP2gFMg/Bc/0amC8p7g4PvjmfO3+oO3h7Xxtu:Pxyjp4Pnfc/ypEaL+O3+oo9Xxtu
                                                                                                                                                                                                                                        MD5:910C0ED11E93D4EF003ED0065A31164A
                                                                                                                                                                                                                                        SHA1:CE3D5B6B289F77F95AF3B60B436FBD9CE821AF2F
                                                                                                                                                                                                                                        SHA-256:37C9DE27CE8EB6326B57DF0E0E477818FC97D6F6B9EC906F029E8E538D7133D7
                                                                                                                                                                                                                                        SHA-512:6D9A9C17B22815B3453E4CA42BC1579448B175F55CC52ECE876F20699BC5DA193E075E86A9B063745797F39D988C457ED56B997DF023EAE9F68BD31E7543F2FE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r?Xk6^686^686^68?&.80^68#!794^68}&794^68#!39:^68#!29>^68#!592^68.#795^686^78.^68..>95^68..697^68...87^68..497^68Rich6^68................PE..d....@.e.........." ...%.....8............................................................`..........................................-..\....-.......`.......P..P............p..d....$..............................@#..@............................................text...(........................... ..`.rdata...$.......&..................@..@.data...p....@....... ..............@....pdata..P....P......."..............@..@.rsrc........`.......(..............@..@.reloc..d....p.......*..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\multidict\_multidict.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):47616
                                                                                                                                                                                                                                        Entropy (8bit):5.315276044408234
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:j2vE6F6hmSrnDe651sYEYMXB/6BvE6n0/d3g:jAoVDeWlE5/6BvDni
                                                                                                                                                                                                                                        MD5:ECC0B2FCDA0485900F4B72B378FE4303
                                                                                                                                                                                                                                        SHA1:40D9571B8927C44AF39F9D2AF8821F073520E65A
                                                                                                                                                                                                                                        SHA-256:BCBB43CE216E38361CB108E99BAB86AE2C0F8930C86D12CADFCA703E26003CB1
                                                                                                                                                                                                                                        SHA-512:24FD07EB0149CB8587200C055F20FF8C260B8E626693C180CBA4E066194BED7E8721DDE758B583C93F7CB3D691B50DE6179BA86821414315C17B3D084D290E70
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..T:l..:l..:l..3.?.8l..*..8l..q...8l..*..9l..*..2l..*..6l..U..9l..:l..Ll..r..;l..r..;l..r.S.;l..r..;l..Rich:l..........................PE..d...;}.f.........." ...).\...`......`^....................................................`.............................................d.......d...............................L.......................................@............p...............................text....Z.......\.................. ..`.rdata...,...p.......`..............@..@.data....#..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\propcache\_helpers_c.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):74752
                                                                                                                                                                                                                                        Entropy (8bit):5.864853826664042
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:kvue4NaxmMtgkBiNWXT+z6eNO/oNJ67bScEq:kvuezmMtgSyWD4NsnbScE
                                                                                                                                                                                                                                        MD5:04444380B89FB22B57E6A72B3AE42048
                                                                                                                                                                                                                                        SHA1:CFE9C662CB5CA1704E3F0763D02E0D59C5817D77
                                                                                                                                                                                                                                        SHA-256:D123D7FEFDE551C82EB61454D763177322E5CE1EAA65DC489E19DE5AB7FAF7B4
                                                                                                                                                                                                                                        SHA-512:9E7D367BAB0F6CC880C5870FDCDB06D9A9E5EB24EBA489CA85549947879B0FA3C586779FFCEA0FCA4C50AA67DAD098E7BD9E82C00E2D00412D9441991267D2DA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..T.l...l...l....?..l......l..Q....l......l......l......l..u...l...l...l..R...l..R...l..R.S..l..R...l..Rich.l..................PE..d......g.........." ...).....l......P........................................p............`.........................................`...d.......d....P.......@..H............`..T.......................................@............................................text............................... ..`.rdata...E.......F..................@..@.data........ ......................@....pdata..H....@......................@..@.rsrc........P....... ..............@..@.reloc..T....`......."..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):67072
                                                                                                                                                                                                                                        Entropy (8bit):5.909510426434191
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:aJsHmR02IvVxv7WCyKm7c5Th4MBHTOvyyaZE:apIvryCyKx5Th4M5OvyyO
                                                                                                                                                                                                                                        MD5:3E579844160DE8322D574501A0F91516
                                                                                                                                                                                                                                        SHA1:C8DE193854F7FC94F103BD4AC726246981264508
                                                                                                                                                                                                                                        SHA-256:95F01CE7E37F6B4B281DBC76E9B88F28A03CB02D41383CC986803275A1CD6333
                                                                                                                                                                                                                                        SHA-512:EE2A026E8E70351D395329C78A07ACB1B9440261D2557F639E817A8149BA625173EF196AED3D1C986577D78DC1A7EC9FED759C19346C51511474FE6D235B1817
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d.....qf.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\pyexpat.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):199448
                                                                                                                                                                                                                                        Entropy (8bit):6.37860626187966
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:JmRBHO1UpyGKEjQxmMLIQjmuMgk6k6k6k6k6k6jHlDX:JmRBHJS7Mgk6k6k6k6k6k6jFDX
                                                                                                                                                                                                                                        MD5:6527063F18E8D49D04E2CC216C2F0B27
                                                                                                                                                                                                                                        SHA1:917C349C62689F9B782A314CE4B2311B6B826606
                                                                                                                                                                                                                                        SHA-256:5604F629523125904909547A97F3CDB5DBFE33B39878BAD77534DE0C3C034387
                                                                                                                                                                                                                                        SHA-512:67C87D11683A0F4E1BC4083FF05EDEE423155F829051C3FA66CC4F2CFB98CF7374B3A06EB37095E19F5F2A6C8DA83F0C0E3F7EB964694992B525F81B1B00F423
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d......e.........." ...#..................................................... ......X.....`.............................................P................................/..........`3..T........................... 2..@............ ...............................text...3........................... ..`.rdata....... ......................@..@.data...@!..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\python3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):67352
                                                                                                                                                                                                                                        Entropy (8bit):6.1462717896521335
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:lGw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJa:r/5k8cnzeJd9IVL0v7SyJwx/
                                                                                                                                                                                                                                        MD5:D8BA00C1D9FCC7C0ABBFFB5C214DA647
                                                                                                                                                                                                                                        SHA1:5FA9D5700B42A83BFCC125D1C45E0111B9D62035
                                                                                                                                                                                                                                        SHA-256:E45452EFA356DB874F2E5FF08C9CC0FE22528609E5D341F8FB67BA48885AB77D
                                                                                                                                                                                                                                        SHA-512:DF1B714494856F618A742791EEFBF470B2EEE07B51D983256E4386EA7D48DA5C7B1E896F222EA55A748C9413203886CDE3A65EF9E7EA069014FA626F81D79CD3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d......e.........." ...#.................................................................`.........................................`...P................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\python311.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5763864
                                                                                                                                                                                                                                        Entropy (8bit):6.089317968812699
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:CdT9zf0+IXY3qd4biqm46oWHrMGYPtA81:CdT9zflIXgq/epGWAs
                                                                                                                                                                                                                                        MD5:65E381A0B1BC05F71C139B0C7A5B8EB2
                                                                                                                                                                                                                                        SHA1:7C4A3ADF21EBCEE5405288FC81FC4BE75019D472
                                                                                                                                                                                                                                        SHA-256:53A969094231B9032ABE4148939CE08A3A4E4B30B0459FC7D90C89F65E8DCD4A
                                                                                                                                                                                                                                        SHA-512:4DB465EF927DFB019AB6FAEC3A3538B0C3A8693EA3C2148FD16163BF31C03C899DFDF350C31457EDF64E671E3CC3E46851F32F0F84B267535BEBC4768EF53D39
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ..qN.qN.qN.$.O.qN.$...qN.$.K.qN.$.J.qN.$.M.qN....qN...O.qN.qO..pN.B.C.]qN.B.N.qN.B...qN.B.L.qN.Rich.qN.........PE..d......e.........." ...#.R%..>7......=........................................\.....T.X...`...........................................@......[A......p[.......V../....W../....[.lC....).T...........................p.).@............p%..............................text...ZQ%......R%................. ..`.rdata.......p%......V%.............@..@.data....#....A..T...fA.............@....pdata.../....V..0....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......vV.............@..@.reloc..lC....[..D....V.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32\pythoncom311.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):670208
                                                                                                                                                                                                                                        Entropy (8bit):6.035999626973864
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:ngSkceIv3zBJBQoXNi4LCQqAOffa1tpd5g:gSkc/v3zB9NiEWfa
                                                                                                                                                                                                                                        MD5:31C1BF2ACA5DF417F6CE2618C3EEFE7E
                                                                                                                                                                                                                                        SHA1:4C2F7FE265FF28396D03BA0CAB022BBD1785DBF2
                                                                                                                                                                                                                                        SHA-256:1DAF7C87B48554F1481BA4431102D0429704832E42E3563501B1FFDD3362FCD1
                                                                                                                                                                                                                                        SHA-512:5723145F718CC659ADD658BA545C5D810E7032842907BAB5C2335E3DE7F20FE69B58AA42512FD67EA8C6AA133E59E0C26BD90700BDD0D0171AF6C1E1C73A2719
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..~f..-f..-f..-o..-l..-4..,b..-4..,q..-4..,n..-4..,b..-...,d..--..,k..-...,d..--..,o..-f..-5..-...,7..-...,g..-...,g..-Richf..-................PE..d...&..g.........." ......................................................................`..........................................U...c..(...........l....@...z............... ..P...T...............................8............................................text............................... ..`.rdata..x$.......&..................@..@.data....I..........................@....pdata...z...@...|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\pywin32_system32\pywintypes311.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):134656
                                                                                                                                                                                                                                        Entropy (8bit):5.999117329459055
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:kLcVKY3tOSjPenBttgY/r06Yr27vJmxETaTX7wevxJ:kLcVKY3tOWPxY/rkqzJmxEmTXMev
                                                                                                                                                                                                                                        MD5:5D67ABF69A8939D13BEFB7DE9889B253
                                                                                                                                                                                                                                        SHA1:BCBBF88C05732D4E1E3811FD312425C1C92018D1
                                                                                                                                                                                                                                        SHA-256:615EB8A75F9ED9371A59DA8F31E27EE091C013DB0B9164A5124CA0656EA47CB4
                                                                                                                                                                                                                                        SHA-512:FA34EB05996C41F23524A8B4F1FAED0BDD41224D8E514AA57D568A55D2044C32798C1357F22C72AD79FD02948CAAD89B98B8E9B0AD2927E4A0169739335271CE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I+.j'x.j'x.j'x...x.j'x..&y.j'x...x.j'x.."y.j'x..#y.j'x..$y.j'x..#y.j'x..&y.j'x..&y.j'x.j&xCj'xk..y.j'xk.'y.j'xk.%y.j'xRich.j'x................PE..d......g.........." ................,........................................P............`..........................................u..lB......,....0..l.......L............@..0....Q..T............................R..8............................................text...y........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\select.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):30488
                                                                                                                                                                                                                                        Entropy (8bit):6.582368880935187
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:neUeJhHq2GD9IVQGA5YiSyv3g+AMxkEdC:neUeJhK2GD9IVQGS7SyfgMxRC
                                                                                                                                                                                                                                        MD5:8472D39B9EE6051C961021D664C7447E
                                                                                                                                                                                                                                        SHA1:B284E3566889359576D43E2E0E99D4ACF068E4FB
                                                                                                                                                                                                                                        SHA-256:8A9A103BC417DEDE9F6946D9033487C410937E1761D93C358C1600B82F0A711F
                                                                                                                                                                                                                                        SHA-512:309F1EC491D9C39F4B319E7CE1ABDEDF11924301E4582D122E261E948705FB71A453FEC34F63DF9F9ABE7F8CC2063A56CD2C2935418AB54BE5596AADC2E90AD3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q|'.q|'.q|'...'.q|'q.}&.q|'q.y&.q|'q.x&.q|'q..&.q|'..}&.q|'.q}'.q|'..}&.q|'..q&.q|'..|&.q|'...'.q|'..~&.q|'Rich.q|'........PE..d......e.........." ...#.....2......................................................;.....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1050
                                                                                                                                                                                                                                        Entropy (8bit):5.072538194763298
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                                                        MD5:7A7126E068206290F3FE9F8D6C713EA6
                                                                                                                                                                                                                                        SHA1:8E6689D37F82D5617B7F7F7232C94024D41066D1
                                                                                                                                                                                                                                        SHA-256:DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
                                                                                                                                                                                                                                        SHA-512:C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6301
                                                                                                                                                                                                                                        Entropy (8bit):5.107162422517841
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:W4rkAIG0wRg8wbNDdq6T9927uoU/GBpHFwTZ:Sq0wRg8wbNDdBh927uoU/GBRFi
                                                                                                                                                                                                                                        MD5:9E59BD13BB75B38EB7962BF64AC30D6F
                                                                                                                                                                                                                                        SHA1:70F6A68B42695D1BFA55ACB63D8D3351352B2AAC
                                                                                                                                                                                                                                        SHA-256:80C7A3B78EA0DFF1F57855EE795E7D33842A0827AA1EF4EE17EC97172A80C892
                                                                                                                                                                                                                                        SHA-512:67AC61739692ECC249EBDC8F5E1089F68874DCD65365DB1C389FDD0CECE381591A30B99A2774B8CAAA00E104F3E35FF3745AFF6F5F0781289368398008537AE7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.1.Name: setuptools.Version: 65.5.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.Project-URL: Documentation, https://setuptools.pypa.io/.Project-URL: Changelog, https://setuptools.pypa.io/en/stable/history.html.Keywords: CPAN PyPI distutils eggs package management.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.7.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requi

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):37694
                                                                                                                                                                                                                                        Entropy (8bit):5.555787611309118
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:vSzcBlShgRUhbul9nXJkpIVh498WjXYH0+5+E/8mrnaDoaQP7IOQRJqxBPgof2yd:vc853yQXYAY8AKCT9r2/GsIVxE9Im
                                                                                                                                                                                                                                        MD5:087F72A04BB085627494651E36C4C513
                                                                                                                                                                                                                                        SHA1:1E39070E246F91D8926268A033C6F584E629E2DE
                                                                                                                                                                                                                                        SHA-256:BFB77A968E06417BD37023BF1A2D7F1AAE9D8E74231665D6699D5BB82BDBD7B0
                                                                                                                                                                                                                                        SHA-512:39CE042A20324C6B63A192D70E56B36318C45D04B810A6BD333D1D40B6DAAD947AFB9156C003BC86C700A59F0F25753416D754DA06C808814920F92582CB6058
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:_distutils_hack/__init__.py,sha256=TSekhUW1fdE3rjU3b88ybSBkJxCEpIeWBob4cEuU3ko,6128.._distutils_hack/__pycache__/__init__.cpython-311.pyc,,.._distutils_hack/__pycache__/override.cpython-311.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=JjjOniUA5XKl4N5_rtZmHrVp0baW_LoHsN0iPaX10iQ,151..pkg_resources/__init__.py,sha256=fT5Y3P1tcSX8sJomClUU10WHeFmvqyNZM4UZHzdpAvg,108568..pkg_resources/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/zipp.cpython-311.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/importlib_resources/__init__.py,sha256=evPm12kLgYqTm-pbzm60bOuumumT8IpBNWFp0uMyrzE,506..pkg_resources/_vendor/importli

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):92
                                                                                                                                                                                                                                        Entropy (8bit):4.820827594031884
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeX7MWcSlViZHKRRP+tPCCfA5S:RtBMwlViojWBBf
                                                                                                                                                                                                                                        MD5:4D57030133E279CEB6A8236264823DFD
                                                                                                                                                                                                                                        SHA1:0FDC3988857C560E55D6C36DCC56EE21A51C196D
                                                                                                                                                                                                                                        SHA-256:1B5E87E00DC87A84269CEAD8578B9E6462928E18A95F1F3373C9EEF451A5BCC0
                                                                                                                                                                                                                                        SHA-512:CD98F2A416AC1B13BA82AF073D0819C0EA7C095079143CAB83037D48E9A5450D410DC5CF6B6CFF3F719544EDF1C5F0C7E32E87B746F1C04FE56FAFD614B39826
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info\entry_points.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2740
                                                                                                                                                                                                                                        Entropy (8bit):4.540737240939103
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:lELcZDy3g6ySDsm90rZh2Phv4hhpTqTog:yLAP8arZoP94hTTqcg
                                                                                                                                                                                                                                        MD5:D3262B65DB35BFFAAC248075345A266C
                                                                                                                                                                                                                                        SHA1:93AD6FE5A696252B9DEF334D182432CDA2237D1D
                                                                                                                                                                                                                                        SHA-256:DEC880BB89189B5C9B1491C9EE8A2AA57E53016EF41A2B69F5D71D1C2FBB0453
                                                                                                                                                                                                                                        SHA-512:1726750B22A645F5537C20ADDF23E3D3BAD851CD4BDBA0F9666F9F6B0DC848F9919D7AF8AD8847BD4F18D0F8585DDE51AFBAE6A4CAD75008C3210D17241E0291
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build = setuptools.command.build:build.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.editable_wheel = setuptools.command.editable_wheel:editable_wheel.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.seto

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\setuptools-65.5.0.dist-info\top_level.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):41
                                                                                                                                                                                                                                        Entropy (8bit):3.9115956018096876
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:3Wd+Nt8AfQYv:3Wd+Nttv
                                                                                                                                                                                                                                        MD5:789A691C859DEA4BB010D18728BAD148
                                                                                                                                                                                                                                        SHA1:AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
                                                                                                                                                                                                                                        SHA-256:77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
                                                                                                                                                                                                                                        SHA-512:BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:_distutils_hack.pkg_resources.setuptools.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\sqlite3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1504024
                                                                                                                                                                                                                                        Entropy (8bit):6.578984314535122
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:M5WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lYfore60b:Mb0yVKMyjWR6nofQm7U59HWKYYD
                                                                                                                                                                                                                                        MD5:256224CC25D085663D4954BE6CC8C5B5
                                                                                                                                                                                                                                        SHA1:9931CC156642E2259DFABF0154FDDF50D86E9334
                                                                                                                                                                                                                                        SHA-256:5AC6EE18CDCA84C078B66055F5E9FFC6F8502E22EAF0FA54AEEC92B75A3C463E
                                                                                                                                                                                                                                        SHA-512:A28ABF03199F0CE9F044329F7EBA2F1D8ECBC43674337AAFBF173F567158BA9046036DA91DC3E12C2BB1D7842953526EDBA14BC03F81ECE63DCEDCC9413213A7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#..................................................................`.........................................Px...".............................../...........*..T............................(..@...............8............................text............................... ..`.rdata..............................@..@.data...PG.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\ucrtbase.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1016584
                                                                                                                                                                                                                                        Entropy (8bit):6.669319438805479
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
                                                                                                                                                                                                                                        MD5:0E0BAC3D1DCC1833EAE4E3E4CF83C4EF
                                                                                                                                                                                                                                        SHA1:4189F4459C54E69C6D3155A82524BDA7549A75A6
                                                                                                                                                                                                                                        SHA-256:8A91052EF261B5FBF3223AE9CE789AF73DFE1E9B0BA5BDBC4D564870A24F2BAE
                                                                                                                                                                                                                                        SHA-512:A45946E3971816F66DD7EA3788AACC384A9E95011500B458212DC104741315B85659E0D56A41570731D338BDF182141C093D3CED222C007038583CEB808E26FD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`............................................................`A................................................p......................F...=......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\unicodedata.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1141016
                                                                                                                                                                                                                                        Entropy (8bit):5.435201566416684
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:C3kYbfjwR6nbVonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1Ji:CUYbM40IDJcjEwPgPOG6Xyd461Ji
                                                                                                                                                                                                                                        MD5:57F8F40CF955561A5044DDFFA4F2E144
                                                                                                                                                                                                                                        SHA1:19218025BCAE076529E49DDE8C74F12E1B779279
                                                                                                                                                                                                                                        SHA-256:1A965C1904DA88989468852FDC749B520CCE46617B9190163C8DF19345B59560
                                                                                                                                                                                                                                        SHA-512:DB2A7A32E0B5BF0684A8C4D57A1D7DF411D8EB1BC3828F44C95235DD3AF40E50A198427350161DFF2E79C07A82EF98E1536E0E013030A15BDF1116154F1D8338
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4m..4m..4m..=...2m......6m......9m......<m......7m......7m......6m..4m..em......5m......5m....j.5m......5m..Rich4m..................PE..d......e.........." ...#.@..........P*...............................................~....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\win32\_win32sysloader.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.113812591033072
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:rCm72PEO1jIUs0YqEcPbF55UgCWV4rofnDPdRD0hvHvcqvn7ycIt/G/:rardA0Bzx14r6nDrOhv+O/
                                                                                                                                                                                                                                        MD5:B58CA169FDCFFAB726391D3906DD9A4E
                                                                                                                                                                                                                                        SHA1:C4BB8DA84A5D9C31D0ACB7A4127F55E696F414DF
                                                                                                                                                                                                                                        SHA-256:1A8DCDBD730166889C03FAF285DC1DD9F16090DFE81043D80A9D6308300EBAC9
                                                                                                                                                                                                                                        SHA-512:AA23DEBF80D89A40677D1BF1C7C6C3445A79E76419865B86D0D6A605656478067EBEA2752348FCF77D583D2E5DCD284DA7F55F751D6441E647565DA77F982966
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Dg..%..%..%..]..%...P..%...]..%...P..%...P..%...P..%.....%..%..%..LP..%..LP..%..LP..%..Rich.%..................PE..d......g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\win32\win32api.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):133120
                                                                                                                                                                                                                                        Entropy (8bit):5.849201651779307
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:znvpE3JJ/Q7DspOCQUUU40Oc3lRVFhLaNzvBii7qQvmwCoY9LQPe:T4xG4pOCQUUU4rWlRVgv5qQSoY9
                                                                                                                                                                                                                                        MD5:D02300D803850C3B0681E16130FECEE4
                                                                                                                                                                                                                                        SHA1:6411815E2A908432A640719ECFE003B43BBBA35C
                                                                                                                                                                                                                                        SHA-256:B938C8CD68B15EC62F053045A764D8DD38162A75373B305B4CF1392AC05DF5F9
                                                                                                                                                                                                                                        SHA-512:6FAD1836614869AB3BB624BDA9943CEAF9E197B17CA4F4FFE78699492B72F95EEE02AE1BB07C0508438956BEF10CC1E656DDF75D0EDC9EF71A3860AF39075564
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..Vx...x...x...q...p...*..|...*..p...*..|......z.......z...*..o...3..s...x...-......z......y......y...Richx...........PE..d......g.........." .........................................................P............`.........................................P...............0..\....................@..X....v..T............................;..8............0.........@....................text............................... ..`.rdata..b....0......................@..@.data...X(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\win32\win32trace.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):23552
                                                                                                                                                                                                                                        Entropy (8bit):5.281874510289411
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:9eeH8ZmV+zknwMswDuVQO0T8DmMel2/QEVR7AWCq5yn9ukF1B3:N+zi/uVQ1Q/QEVR1NUpB
                                                                                                                                                                                                                                        MD5:965E9833F4CD7A45C2C1EE85EFC2DA3B
                                                                                                                                                                                                                                        SHA1:3C6888194AD30E17DC5EEA7418133A541BCDDF07
                                                                                                                                                                                                                                        SHA-256:5ECD0274DC220312824BB3086B3E129E38A9DCB06913A2F6173A94DC256BF4C5
                                                                                                                                                                                                                                        SHA-512:F8C4E0C82A8229B3BDB897B536EE73B5D2A9A2810B73DCC77C880961A9A16E43746234A108A9A15BF18638FCFB3086E0F5EEFD85D5BF6F799718DC6F199C4A26
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(U.wF..wF..wF......wF...G..wF...C..wF...B..wF...E..wF.D.G..wF...G..wF...G..wF..wG..wF.D.O..wF.D.F..wF.D.D..wF.Rich.wF.................PE..d......g.........." .....,...,.......(....................................................`......................................... Q..T...tQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\win32com\shell\shell.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):535040
                                                                                                                                                                                                                                        Entropy (8bit):6.1723495244729625
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:SBetHVSFgAXb3MWUF6w7FK3oHPl8eqTOU:SQkgAL3Md983C8eq
                                                                                                                                                                                                                                        MD5:43AA404015B0CEE369E941DC30B3F4B0
                                                                                                                                                                                                                                        SHA1:A34CBA0D08A17934D84B16FCFF5282367EAA08AA
                                                                                                                                                                                                                                        SHA-256:3FB83E9A14901321324F17D11DA50802B6777733E1EE0FD4F89DB0FD09C61690
                                                                                                                                                                                                                                        SHA-512:A8548F39F371B2389EEA45DA4248FFC015F5B243E957BD12B88661DB91D4D745A1CD1E772BDD6C739A87E69A88947FB58248BB394E1C5D21C0A9324EFC87724B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#t.wM'.wM'.wM'...'.wM'..L&.wM'..H&.wM'..I&.wM'..N&.wM'..I&.wM'..L&.wM'!.L&.wM'..K&.wM'..L&.wM'.wL'.wM'!.D&.wM'!.M&.wM'!.O&.wM'Rich.wM'........PE..d...}..g.........." .....2................................................................`.............................................L...<...........L....0..${..............h!......T...............................8............P..(............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data........P...`...(..............@....pdata..${...0...|..................@..@.rsrc...L...........................@..@.reloc..h!......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI64162\yarl\_quoting_c.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):97280
                                                                                                                                                                                                                                        Entropy (8bit):5.965911733978745
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:xtuirzB429BT5WTY4yBRmWHdRfIIGrzf9NzeXzf2RUd:xtugP5y7uf9N81NzeDuRU
                                                                                                                                                                                                                                        MD5:1C6C610E5E2547981A2F14F240ACCF20
                                                                                                                                                                                                                                        SHA1:4A2438293D2F86761EF84CFDF99A6CA86604D0B8
                                                                                                                                                                                                                                        SHA-256:4A982FF53E006B462DDF7090749BC06EBB6E97578BE04169489D27E93F1D1804
                                                                                                                                                                                                                                        SHA-512:F6EA205A49BF586D7F3537D56B805D34584A4C2C7D75A81C53CE457A4A438590F6DBEDED324362BFE18B86FF5696673DE5FBE4C9759AD121B5E4C9AE2EF267C0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:m.]~...~...~...wt..z...n...|...5t..|...n...}...n...v...n...r.......}...~.......5.......5.......5.g.....5.......Rich~...........................PE..d....."g.........." ...)............P.....................................................`..........................................Y..d....Z..x...............................,....G...............................F..@............ ...............................text............................... ..`.rdata...N... ...P..................@..@.data...P7...p.......`..............@....pdata...............l..............@..@.rsrc................x..............@..@.reloc..,............z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11264
                                                                                                                                                                                                                                        Entropy (8bit):4.640339306680604
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
                                                                                                                                                                                                                                        MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
                                                                                                                                                                                                                                        SHA1:EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
                                                                                                                                                                                                                                        SHA-256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
                                                                                                                                                                                                                                        SHA-512:8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.0194545642425075
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
                                                                                                                                                                                                                                        MD5:F19CB847E567A31FAB97435536C7B783
                                                                                                                                                                                                                                        SHA1:4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
                                                                                                                                                                                                                                        SHA-256:1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
                                                                                                                                                                                                                                        SHA-512:382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.037456384995606
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
                                                                                                                                                                                                                                        MD5:DC14677EA8A8C933CC41F9CCF2BEDDC1
                                                                                                                                                                                                                                        SHA1:A6FB87E8F3540743097A467ABE0723247FDAF469
                                                                                                                                                                                                                                        SHA-256:68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
                                                                                                                                                                                                                                        SHA-512:3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.09191874780435
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
                                                                                                                                                                                                                                        MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
                                                                                                                                                                                                                                        SHA1:46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
                                                                                                                                                                                                                                        SHA-256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
                                                                                                                                                                                                                                        SHA-512:691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                        Entropy (8bit):6.541423493519083
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
                                                                                                                                                                                                                                        MD5:0AB25F99CDAACA6B11F2ECBE8223CAD5
                                                                                                                                                                                                                                        SHA1:7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
                                                                                                                                                                                                                                        SHA-256:6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
                                                                                                                                                                                                                                        SHA-512:11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.367749645917753
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
                                                                                                                                                                                                                                        MD5:B6EA675C3A35CD6400A7ECF2FB9530D1
                                                                                                                                                                                                                                        SHA1:0E41751AA48108D7924B0A70A86031DDE799D7D6
                                                                                                                                                                                                                                        SHA-256:76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
                                                                                                                                                                                                                                        SHA-512:E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):16384
                                                                                                                                                                                                                                        Entropy (8bit):5.41148259289073
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
                                                                                                                                                                                                                                        MD5:F14E1AA2590D621BE8C10321B2C43132
                                                                                                                                                                                                                                        SHA1:FD84D11619DFFDF82C563E45B48F82099D9E3130
                                                                                                                                                                                                                                        SHA-256:FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
                                                                                                                                                                                                                                        SHA-512:A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20992
                                                                                                                                                                                                                                        Entropy (8bit):6.041302713678401
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
                                                                                                                                                                                                                                        MD5:B127CAE435AEB8A2A37D2A1BC1C27282
                                                                                                                                                                                                                                        SHA1:2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
                                                                                                                                                                                                                                        SHA-256:538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
                                                                                                                                                                                                                                        SHA-512:4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):24576
                                                                                                                                                                                                                                        Entropy (8bit):6.530656045206549
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
                                                                                                                                                                                                                                        MD5:2E15AA6F97ED618A3236CFA920988142
                                                                                                                                                                                                                                        SHA1:A9D556D54519D3E91FA19A936ED291A33C0D1141
                                                                                                                                                                                                                                        SHA-256:516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
                                                                                                                                                                                                                                        SHA-512:A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.7080156150187396
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
                                                                                                                                                                                                                                        MD5:40390F2113DC2A9D6CFAE7127F6BA329
                                                                                                                                                                                                                                        SHA1:9C886C33A20B3F76B37AA9B10A6954F3C8981772
                                                                                                                                                                                                                                        SHA-256:6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
                                                                                                                                                                                                                                        SHA-512:617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):5.159963979391524
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
                                                                                                                                                                                                                                        MD5:899895C0ED6830C4C9A3328CC7DF95B6
                                                                                                                                                                                                                                        SHA1:C02F14EBDA8B631195068266BA20E03210ABEABC
                                                                                                                                                                                                                                        SHA-256:18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
                                                                                                                                                                                                                                        SHA-512:0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.270418334522813
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
                                                                                                                                                                                                                                        MD5:C4C525B081F8A0927091178F5F2EE103
                                                                                                                                                                                                                                        SHA1:A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
                                                                                                                                                                                                                                        SHA-256:4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
                                                                                                                                                                                                                                        SHA-512:7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):56832
                                                                                                                                                                                                                                        Entropy (8bit):4.231032526864278
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
                                                                                                                                                                                                                                        MD5:F9E266F763175B8F6FD4154275F8E2F0
                                                                                                                                                                                                                                        SHA1:8BE457700D58356BC2FA7390940611709A0E5473
                                                                                                                                                                                                                                        SHA-256:14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
                                                                                                                                                                                                                                        SHA-512:EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):57344
                                                                                                                                                                                                                                        Entropy (8bit):4.252429732285762
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
                                                                                                                                                                                                                                        MD5:DECF524B2D53FCD7D4FA726F00B3E5FC
                                                                                                                                                                                                                                        SHA1:E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
                                                                                                                                                                                                                                        SHA-256:58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
                                                                                                                                                                                                                                        SHA-512:EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.690163963718492
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
                                                                                                                                                                                                                                        MD5:80BB1E0E06ACAF03A0B1D4EF30D14BE7
                                                                                                                                                                                                                                        SHA1:B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
                                                                                                                                                                                                                                        SHA-256:5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
                                                                                                                                                                                                                                        SHA-512:2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):6.1215844022564285
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
                                                                                                                                                                                                                                        MD5:3727271FE04ECB6D5E49E936095E95BC
                                                                                                                                                                                                                                        SHA1:46182698689A849A8C210A8BF571D5F574C6F5B1
                                                                                                                                                                                                                                        SHA-256:3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
                                                                                                                                                                                                                                        SHA-512:5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.293810509074883
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
                                                                                                                                                                                                                                        MD5:78AEF441C9152A17DD4DC40C7CC9DF69
                                                                                                                                                                                                                                        SHA1:6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
                                                                                                                                                                                                                                        SHA-256:56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
                                                                                                                                                                                                                                        SHA-512:27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11776
                                                                                                                                                                                                                                        Entropy (8bit):4.862619033406922
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
                                                                                                                                                                                                                                        MD5:19E0ABF76B274C12FF624A16713F4999
                                                                                                                                                                                                                                        SHA1:A4B370F556B925F7126BF87F70263D1705C3A0DB
                                                                                                                                                                                                                                        SHA-256:D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
                                                                                                                                                                                                                                        SHA-512:D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.227045547076371
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
                                                                                                                                                                                                                                        MD5:309D6F6B0DD022EBD9214F445CAC7BB9
                                                                                                                                                                                                                                        SHA1:ABD22690B7AD77782CFC0D2393D0C038E16070B0
                                                                                                                                                                                                                                        SHA-256:4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
                                                                                                                                                                                                                                        SHA-512:D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.176369829782773
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
                                                                                                                                                                                                                                        MD5:D54FEB9A270B212B0CCB1937C660678A
                                                                                                                                                                                                                                        SHA1:224259E5B684C7AC8D79464E51503D302390C5C9
                                                                                                                                                                                                                                        SHA-256:032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
                                                                                                                                                                                                                                        SHA-512:29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.047563322651927
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
                                                                                                                                                                                                                                        MD5:52DCD4151A9177CF685BE4DF48EA9606
                                                                                                                                                                                                                                        SHA1:F444A4A5CBAE9422B408420115F0D3FF973C9705
                                                                                                                                                                                                                                        SHA-256:D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
                                                                                                                                                                                                                                        SHA-512:64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.09893680790018
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
                                                                                                                                                                                                                                        MD5:F929B1A3997427191E07CF52AC883054
                                                                                                                                                                                                                                        SHA1:C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
                                                                                                                                                                                                                                        SHA-256:5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
                                                                                                                                                                                                                                        SHA-512:2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.451865349855574
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
                                                                                                                                                                                                                                        MD5:1FA5E257A85D16E916E9C22984412871
                                                                                                                                                                                                                                        SHA1:1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
                                                                                                                                                                                                                                        SHA-256:D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
                                                                                                                                                                                                                                        SHA-512:E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.104245335186531
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
                                                                                                                                                                                                                                        MD5:FAD578A026F280C1AE6F787B1FA30129
                                                                                                                                                                                                                                        SHA1:9A3E93818A104314E172A304C3D117B6A66BEB55
                                                                                                                                                                                                                                        SHA-256:74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
                                                                                                                                                                                                                                        SHA-512:ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.671305741258107
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
                                                                                                                                                                                                                                        MD5:556E6D0E5F8E4DA74C2780481105D543
                                                                                                                                                                                                                                        SHA1:7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
                                                                                                                                                                                                                                        SHA-256:247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
                                                                                                                                                                                                                                        SHA-512:28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....*..........P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                        Entropy (8bit):5.878701941774916
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
                                                                                                                                                                                                                                        MD5:2F2655A7BBFE08D43013EDDA27E77904
                                                                                                                                                                                                                                        SHA1:33D51B6C423E094BE3E34E5621E175329A0C0914
                                                                                                                                                                                                                                        SHA-256:C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
                                                                                                                                                                                                                                        SHA-512:8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                        Entropy (8bit):5.881781476285865
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
                                                                                                                                                                                                                                        MD5:CDE035B8AB3D046B1CE37EEE7EE91FA0
                                                                                                                                                                                                                                        SHA1:4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
                                                                                                                                                                                                                                        SHA-256:16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
                                                                                                                                                                                                                                        SHA-512:C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                        Entropy (8bit):5.837887867708438
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
                                                                                                                                                                                                                                        MD5:999D431197D7E06A30E0810F1F910B9A
                                                                                                                                                                                                                                        SHA1:9BFF781221BCFFD8E55485A08627EC2A37363C96
                                                                                                                                                                                                                                        SHA-256:AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
                                                                                                                                                                                                                                        SHA-512:A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                        Entropy (8bit):5.895310340516013
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
                                                                                                                                                                                                                                        MD5:0931ABBF3AED459B1A2138B551B1D3BB
                                                                                                                                                                                                                                        SHA1:9EC0296DDAF574A89766A2EC035FC30073863AB0
                                                                                                                                                                                                                                        SHA-256:1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
                                                                                                                                                                                                                                        SHA-512:9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):4.967737129255606
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
                                                                                                                                                                                                                                        MD5:5F057A380BACBA4EF59C0611549C0E02
                                                                                                                                                                                                                                        SHA1:4B758D18372D71F0AA38075F073722A55B897F71
                                                                                                                                                                                                                                        SHA-256:BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
                                                                                                                                                                                                                                        SHA-512:E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.007867576025166
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
                                                                                                                                                                                                                                        MD5:49BCA1B7DF076D1A550EE1B7ED3BD997
                                                                                                                                                                                                                                        SHA1:47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
                                                                                                                                                                                                                                        SHA-256:49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
                                                                                                                                                                                                                                        SHA-512:8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15872
                                                                                                                                                                                                                                        Entropy (8bit):5.226023387740053
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
                                                                                                                                                                                                                                        MD5:CB5CFDD4241060E99118DEEC6C931CCC
                                                                                                                                                                                                                                        SHA1:1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
                                                                                                                                                                                                                                        SHA-256:A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
                                                                                                                                                                                                                                        SHA-512:8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.262055670423592
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
                                                                                                                                                                                                                                        MD5:18D2D96980802189B23893820714DA90
                                                                                                                                                                                                                                        SHA1:5DEE494D25EB79038CBC2803163E2EF69E68274C
                                                                                                                                                                                                                                        SHA-256:C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
                                                                                                                                                                                                                                        SHA-512:0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                        Entropy (8bit):5.913843738203007
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
                                                                                                                                                                                                                                        MD5:EF472BA63FD22922CA704B1E7B95A29E
                                                                                                                                                                                                                                        SHA1:700B68E7EF95514D5E94D3C6B10884E1E187ACD8
                                                                                                                                                                                                                                        SHA-256:66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
                                                                                                                                                                                                                                        SHA-512:DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.735350805948923
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
                                                                                                                                                                                                                                        MD5:3B1CE70B0193B02C437678F13A335932
                                                                                                                                                                                                                                        SHA1:063BFD5A32441ED883409AAD17285CE405977D1F
                                                                                                                                                                                                                                        SHA-256:EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
                                                                                                                                                                                                                                        SHA-512:0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_curve25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22528
                                                                                                                                                                                                                                        Entropy (8bit):5.705606408072877
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
                                                                                                                                                                                                                                        MD5:FF33C306434DEC51D39C7BF1663E25DA
                                                                                                                                                                                                                                        SHA1:665FCF47501F1481534597C1EAC2A52886EF0526
                                                                                                                                                                                                                                        SHA-256:D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
                                                                                                                                                                                                                                        SHA-512:66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_curve448.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):70656
                                                                                                                                                                                                                                        Entropy (8bit):6.0189903352673655
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
                                                                                                                                                                                                                                        MD5:F267BF4256F4105DAD0D3E59023011ED
                                                                                                                                                                                                                                        SHA1:9BC6CA0F375CE49D5787C909D290C07302F58DA6
                                                                                                                                                                                                                                        SHA-256:1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
                                                                                                                                                                                                                                        SHA-512:A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):770560
                                                                                                                                                                                                                                        Entropy (8bit):7.613224993327352
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
                                                                                                                                                                                                                                        MD5:1EFD7F7CB1C277416011DE6F09C355AF
                                                                                                                                                                                                                                        SHA1:C0F97652AC2703C325AB9F20826A6F84C63532F2
                                                                                                                                                                                                                                        SHA-256:AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
                                                                                                                                                                                                                                        SHA-512:2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26112
                                                                                                                                                                                                                                        Entropy (8bit):5.8551858881598795
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
                                                                                                                                                                                                                                        MD5:C5FB377F736ED731B5578F57BB765F7A
                                                                                                                                                                                                                                        SHA1:5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
                                                                                                                                                                                                                                        SHA-256:32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
                                                                                                                                                                                                                                        SHA-512:D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):84992
                                                                                                                                                                                                                                        Entropy (8bit):6.064677498000638
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
                                                                                                                                                                                                                                        MD5:8A0C0AA820E98E83AC9B665A9FD19EAF
                                                                                                                                                                                                                                        SHA1:6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
                                                                                                                                                                                                                                        SHA-256:4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
                                                                                                                                                                                                                                        SHA-512:52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.675380950473425
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
                                                                                                                                                                                                                                        MD5:44B930B89CE905DB4716A548C3DB8DEE
                                                                                                                                                                                                                                        SHA1:948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
                                                                                                                                                                                                                                        SHA-256:921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
                                                                                                                                                                                                                                        SHA-512:79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.625428549874022
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
                                                                                                                                                                                                                                        MD5:F24F9356A6BDD29B9EF67509A8BC3A96
                                                                                                                                                                                                                                        SHA1:A26946E938304B4E993872C6721EB8CC1DCBE43B
                                                                                                                                                                                                                                        SHA-256:034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
                                                                                                                                                                                                                                        SHA-512:C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11264
                                                                                                                                                                                                                                        Entropy (8bit):4.704418348721006
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:nDzsc9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDj90OcX6gY/7ECFV:Dzs69damqTrpYTst0E5DjPcqgY/79X
                                                                                                                                                                                                                                        MD5:85F144F57905F68ECBF14552BAB2F070
                                                                                                                                                                                                                                        SHA1:83A20193E6229EA09DCCAE8890A74DBDD0A76373
                                                                                                                                                                                                                                        SHA-256:28696C8881D9C9272DE4E54ABE6760CD4C6CB22AD7E3FEABAF6FF313EC9A9EAF
                                                                                                                                                                                                                                        SHA-512:533EB4073594BFE97850DFF7353439BACD4E19539E247EE00D599F3468E162D2D88C5CA32322772538A73706DF9A6DD14553B35F47C686D2E20D915FAB766BDA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...O..e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):4.968532257508093
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:JF3rugNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDq4wYH/kcX6G:tF/1nb2mhQtkXHTeZ87VDqyMcqgYvEp
                                                                                                                                                                                                                                        MD5:14A20ED2868F5B3D7DCFEF9363CB1F32
                                                                                                                                                                                                                                        SHA1:C1F2EF94439F42AA39DCDE1075DEFAC8A6029DC6
                                                                                                                                                                                                                                        SHA-256:A072631CD1757D5147B5E403D6A96EF94217568D1DC1AE5C67A1892FBF61409E
                                                                                                                                                                                                                                        SHA-512:33BE8B3733380C3ADFE5D2844819C754FB11FCBC7AA75DA8FBB4D6CEF938E7D3267FBD215B9666DCFA5795D54484360A61DAF193BC75B57C252D44E5F9F0D855
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.061520684813544
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:cdF/1nb2mhQtkXn0t/WS60YYDEbqvdvGyv9lkVcqgYvEMo:e2f6XSZ6XYD5vdvGyv9MgYvEMo
                                                                                                                                                                                                                                        MD5:E2AB7EECFD020CFDEBA6DD3ADD732EB7
                                                                                                                                                                                                                                        SHA1:26975087F7AC8001830CAD4151003DBCABF82126
                                                                                                                                                                                                                                        SHA-256:85BCF0FD811ADE1396E3A93EEEF6BC6B88D5555498BA09C164FAA3092DACDEFF
                                                                                                                                                                                                                                        SHA-512:EB45126A07128E0FA8DC2B687F833BA95BB8703D7BC06E5C34F828EAEF062CFCA56D8A51A73B20DFA771595F6C6D830B659B5C0EB62467C61E95C97C4A73398D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.236611028290556
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:osiHXqpoUol3xZhRyQX5lDnRDFFav+tcqgRvE:K6D+XBDfDgRvE
                                                                                                                                                                                                                                        MD5:7FA5B1642D52FABFE1D3EBD1080056D4
                                                                                                                                                                                                                                        SHA1:56B9E87D613EE9A8B6B71A93ED5FA1603886139A
                                                                                                                                                                                                                                        SHA-256:88C7EC96B9E1D168005B3A8727AAA7F76B4B2985083ED7A9FB0A2AB02446E963
                                                                                                                                                                                                                                        SHA-512:9E0BF47060A2B7AC8FFD2CB8B845D44013C068BFE74926A67496D79BCB513506625BDA1DDF18ECE7777D1379F036506F19457D0A43FA618A8F75664C47798E64
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..*...*...*...R...*...U...*..R...*...*...*...U...*...U...*...U...*.....*.....*...}..*.....*..Rich.*..........................PE..d...N..e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                        Entropy (8bit):6.558039926510444
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:Dz5P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuTLg46:DzdqWB7YJlmLJ3oD/S4j990th9VTsC
                                                                                                                                                                                                                                        MD5:E63FC8375E1D8C47FBB84733F38A9552
                                                                                                                                                                                                                                        SHA1:995C32515AA183DA58F970CEDC6667FAE166615A
                                                                                                                                                                                                                                        SHA-256:F47F9C559A9C642DA443896B5CD24DE74FED713BDF6A9CD0D20F5217E4124540
                                                                                                                                                                                                                                        SHA-512:4213189F619E7AA71934033CABA401FE93801B334BA8D8EAFEDA89F19B13224C516E4BB4F4F93F6AE2C21CD8F5586D3FFAC3D16CB1242183B9302A1F408F6F6A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...L..e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15872
                                                                                                                                                                                                                                        Entropy (8bit):5.285246086368036
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:jJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4mqccqgwYUMvEW:ZkRwi3wO26Ef+yuIm9PfDewgwYUMvE
                                                                                                                                                                                                                                        MD5:A914F3D22DA22F099CB0FBFBBB75DDBF
                                                                                                                                                                                                                                        SHA1:2834AEB657CA301D722D6D4D1672239C83BE97E3
                                                                                                                                                                                                                                        SHA-256:4B4DBF841EC939EF9CC4B4F1B1BA436941A3F2AF2F4E34F82C568DFC09BA0358
                                                                                                                                                                                                                                        SHA-512:15BF5FCE53FB2C524054D02C2E48E3DDC4EAC0C1F73325D58B04DFE17259C208FFAC0A7C634FBC2CF1A08E7F28C1FD456061BA0838F4316EB37514E1E8D4C95F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d...L..e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):16384
                                                                                                                                                                                                                                        Entropy (8bit):5.505232918566824
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:9d9VkyQ5f8vjVaCHpKpTTjaNe7oca2DWZQ2dhmdcqgwNeecBih:rkP5cjIGpKlqD2DakzgwNeE
                                                                                                                                                                                                                                        MD5:9F1A2A9D731E7755EE93C82C91FA5FE2
                                                                                                                                                                                                                                        SHA1:41085FBE84E1B98A795871033034FA1F186274EF
                                                                                                                                                                                                                                        SHA-256:17F3EAF463868B015583BD611BE5251E36AAB616522FF4072011B3D72F6F552F
                                                                                                                                                                                                                                        SHA-512:7E29D4729837D87AEF34CFA7B1F86DFBB81907CD11FC575C4ED1B8A956409492315BFA76ADE4D7C51E51E37E5D098A7F4FEE4C58D86D0E6245A4AA0D392D488A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20992
                                                                                                                                                                                                                                        Entropy (8bit):6.061115794354147
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:pUv5cJMOZA0nmwBD+XpJgLa0Mp8QHg4P2llyM:GK1XBD+DgLa1gTi
                                                                                                                                                                                                                                        MD5:883DE82B3B17F95735F579E78A19D509
                                                                                                                                                                                                                                        SHA1:3EC7259ACA3730B2A6F4E1CA5121DB4AB41C619E
                                                                                                                                                                                                                                        SHA-256:67FF6C8BBDC9E33B027D53A26DF39BA2A2AD630ACCE1BAC0B0583CA31ADF914F
                                                                                                                                                                                                                                        SHA-512:602915EAA0933F5D1A26ECC1C32A8367D329B12794CBF2E435B1704E548858E64710AB52BC6FC14FC98DF0B8EEBDE2B32A35BCF935079CC8E2412C07DF5303FD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):25088
                                                                                                                                                                                                                                        Entropy (8bit):6.475398255636883
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:Zc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy7IYgLWi:q6H1TZXX5XmrXA+NNxWi0dLWi
                                                                                                                                                                                                                                        MD5:0AC22DA9F0B2F84DE9D2B50D457020C1
                                                                                                                                                                                                                                        SHA1:682E316AE958121D0E704CAB0F78CCAD42C77573
                                                                                                                                                                                                                                        SHA-256:480C79C713AD15328E9EB9F064B90BCDCB5AAD149236679F97B61218F6D2D200
                                                                                                                                                                                                                                        SHA-512:11C04D55C5E73583D658E0918BD5A37C7585837A6E0F3C78AEF10A5D7A5C848B0620028177A9D9B0AD5DB882B2A26624F92BEFC9BC8F8A23C002723E50DD80A5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.839420412830416
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:CF/1nb2mhQtkr+juOxKbDbRHcqgYvEkrK:42f6iuOsbDXgYvEmK
                                                                                                                                                                                                                                        MD5:6840F030DF557B08363C3E96F5DF3387
                                                                                                                                                                                                                                        SHA1:793A8BA0A7BDB5B7E510FC9A9DDE62B795F369AE
                                                                                                                                                                                                                                        SHA-256:B7160ED222D56925E5B2E247F0070D5D997701E8E239EC7F80BCE21D14FA5816
                                                                                                                                                                                                                                        SHA-512:EDF5A4D5A3BFB82CC140CE6CE6E9DF3C8ED495603DCF9C0D754F92F265F2DCE6A83F244E0087309B42930D040BF55E66F34504DC1C482A274AD8262AA37D1467
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...N..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):4.905258571193623
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:fRgPX8lvI+KnwSDTPUDEnKWPXcqgzQkvEd:4og9rUD/mpgzQkvE
                                                                                                                                                                                                                                        MD5:7256877DD2B76D8C6D6910808222ACD8
                                                                                                                                                                                                                                        SHA1:C6468DB06C4243CE398BEB83422858B3FED76E99
                                                                                                                                                                                                                                        SHA-256:DBF703293CFF0446DFD15BBAEDA52FB044F56A353DDA3BECA9AADD8A959C5798
                                                                                                                                                                                                                                        SHA-512:A14D460D96845984F052A8509E8FC44439B616EEAE46486DF20F21CCAA8CFB1E55F1E4FA2F11A7B6AB0A481DE62636CEF19EB5BEF2591FE83D415D67EB605B8E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...N..e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.300728193650235
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:jGYJ1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDr6krRcqgUF6+6vEX:jR01si8XSi3SACqe7tDlDgUUjvE
                                                                                                                                                                                                                                        MD5:B063D73E5AA501060C303CAFBC72DAD3
                                                                                                                                                                                                                                        SHA1:8C1CA04A8ED34252EB233C993DDBA17803E0B81E
                                                                                                                                                                                                                                        SHA-256:98BACA99834DE65FC29EFA930CD9DBA8DA233B4CFDFC4AB792E1871649B2FE5C
                                                                                                                                                                                                                                        SHA-512:8C9AD249F624BDF52A3C789C32532A51D3CC355646BD725553A738C4491EA483857032FB20C71FD3698D7F68294E3C35816421DFF263D284019A9A4774C3AF05
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..*B..*B..*B..R...*B..UC..*B.RC..*B..*C..*B..UG..*B..UF..*B..UA..*B..J..*B..B..*B....*B..@..*B.Rich.*B.........................PE..d...O..e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):57856
                                                                                                                                                                                                                                        Entropy (8bit):4.260136375669177
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:9RUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZvZY0JAIg+v:9rHGHfJidIK
                                                                                                                                                                                                                                        MD5:3AEA5302F7F03EDEFF49D1C119C61693
                                                                                                                                                                                                                                        SHA1:DBDDE1C10B253744153FC1F47C078AAACCF3F3A6
                                                                                                                                                                                                                                        SHA-256:E5DDA67D4DF47B7F00FF17BE6541CA80BDB4B60E1F6FD1A7D7F115DDF7683EE5
                                                                                                                                                                                                                                        SHA-512:DD42C24EDAF7E1B25A51BC8C96447496B3289C612C395CA7BD8BF60A162229C2E0CA0432CDDF1CB2D65D80189DB02BEE42FFD0E7DD9E5FC19278CA3FD593AB2C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...M..e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):58368
                                                                                                                                                                                                                                        Entropy (8bit):4.276947153784193
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:98Uqho9weF5/eHkRnYcZiGKdZHDL7idErZ8ZYXGg:9gCneH//idv2
                                                                                                                                                                                                                                        MD5:BA5BA714AEBFD8130EB6E0983FBAE20B
                                                                                                                                                                                                                                        SHA1:3309C26A9083EC3AD982DD3D6630FCC16465F251
                                                                                                                                                                                                                                        SHA-256:861167DFEB390261E538D635EAD213E81C1166D8D85A496774FBF2EBFF5A4332
                                                                                                                                                                                                                                        SHA-512:309CC3FD8DB62517AE70B404C5ACD01052F10582A17123135CD1A28D3A74AB28F90A8E7ED7D2061A4B6C082F85E98DA822D43986FC99367B288A72BA9F8B5569
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...N..e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.579354442149926
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:j0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwoYPj15XkcX6gbW6z:pVddiT7pgTctEEI4qXDe11kcqgbW6
                                                                                                                                                                                                                                        MD5:1C74E15EC55BD8767968024D76705EFC
                                                                                                                                                                                                                                        SHA1:C590D1384D2207B3AF01A46A5B4F7A2AE6BCAD93
                                                                                                                                                                                                                                        SHA-256:0E3EC56A1F3C86BE1CAA503E5B89567AA91FD3D6DA5AD4E4DE4098F21270D86B
                                                                                                                                                                                                                                        SHA-512:E96CA56490FCE7E169CC0AB803975BAA8B5ACB8BBAB5047755AE2EEAE177CD4B852C0620CD77BCFBC81AD18BB749DEC65D243D1925288B628F155E8FACDC3540
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):6.143744403797058
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:7Uv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Qy0gYP2lXCM:UKR8I+K0lDFQgLa1WzU
                                                                                                                                                                                                                                        MD5:E7826C066423284539BD1F1E99BA0CC6
                                                                                                                                                                                                                                        SHA1:DA7372EEB180C2E9A6662514A8FA6261E04AC6DC
                                                                                                                                                                                                                                        SHA-256:0E18B7C2686BB954A8EE310DD5FDB76D00AC078A12D883028BFFC336E8606DA2
                                                                                                                                                                                                                                        SHA-512:55F8B00B54F3C3E80803D5A3611D5301E29A2C6AF6E2CAA36249AEBA1D4FCC5A068875B34D65106C137F0455F11B20226B48EEF687F5EA73DFEA3C852BF07050
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.353670931504009
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:tPHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8Ng6Vf4A:DPcnB8KSsB34cb+bcOYpMCBDB
                                                                                                                                                                                                                                        MD5:D5DB7192A65D096433F5F3608E5AD922
                                                                                                                                                                                                                                        SHA1:22AD6B635226C8F6B94F85E4FBFB6F8C18B613C8
                                                                                                                                                                                                                                        SHA-256:FAB286E26160820167D427A4AAB14BE4C23883C543E2B0C353F931C89CEA3638
                                                                                                                                                                                                                                        SHA-512:5503E83D68D144A6D182DCC5E8401DD81C1C98B04B5ED24223C77D94B0D4F2DD1DD05AED94B9D619D30D2FE73DFFA6E710664FFC71B8FA53E735F968B718B1D9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...O..e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.741875402338703
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:sCF/1nb2mhQtkgU7L9D0E7tfcqgYvEJPb:N2f6L9D5JxgYvEJj
                                                                                                                                                                                                                                        MD5:134F891DE4188C2428A2081E10E675F0
                                                                                                                                                                                                                                        SHA1:22CB9B0FA0D1028851B8D28DAFD988D25E94D2FD
                                                                                                                                                                                                                                        SHA-256:F326AA2A582B773F4DF796035EC9BF69EC1AD11897C7D0ECFAB970D33310D6BA
                                                                                                                                                                                                                                        SHA-512:43CE8AF33630FD907018C62F100BE502565BAD712AD452A327AE166BD305735799877E14BE7A46D243D834F3F884ABF6286088E30533050ED9CD05D23AACAEAB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...O..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.213290591994899
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:oF/1nb2mhQtkRySMfJ2ycxFzShJD9dAal2QDeJKcqgQx2QY:C2fKRQB2j8JD4fJagQx2QY
                                                                                                                                                                                                                                        MD5:7D6979D69CD34652D5A3A197300AB65C
                                                                                                                                                                                                                                        SHA1:E9C7EF62B7042B3BAC75B002851C41EFEEE343CE
                                                                                                                                                                                                                                        SHA-256:2365B7C2AF8BBAC3844B7BEF47D5C49C234A159234A153515EB0634EEC0557CC
                                                                                                                                                                                                                                        SHA-512:CBDBE0DF4F6CB6796D54969B0EEF06C0CDA86FF34A2B127BF0272C819FB224D6E5393D5C9B31E53A24EAC9A3A1AEA6E0854A8D7911CF7C4C99292C931B8B05DF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.181893965844124
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:cF/1nb2mhQt7fSOp/CJPvADQoKtxSOvbcqgEvcM+:22fNKOZWPIDMxVlgEvL
                                                                                                                                                                                                                                        MD5:C3BA97B2D8FFFDB05F514807C48CABB2
                                                                                                                                                                                                                                        SHA1:7BC7FBDE6A372E5813491BBD538FD49C0A1B7C26
                                                                                                                                                                                                                                        SHA-256:4F78E61B376151CA2D0856D2E59976670F5145FBABAB1EEC9B2A3B5BEBB4EEF6
                                                                                                                                                                                                                                        SHA-512:57C1A62D956D8C6834B7BA81C2D125A40BF466E833922AE3759CF2C1017F8CAF29F4502A5A0BCBC95D74639D86BAF20F0335A45F961CFCAC39B4ED81E318F4EB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_MD2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.1399121410532445
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:HsiHXqpo0cUp8XnUp8XjEQnlDtTI6rcqgcx2:J6DcUp8XUp8AclDy69gcx2
                                                                                                                                                                                                                                        MD5:BB4CF5E97D4031B47CC7B7DAEDA005DD
                                                                                                                                                                                                                                        SHA1:4F596DCE9A8546AE22BA8851B22FCE62C2C69973
                                                                                                                                                                                                                                        SHA-256:325512FF7E0261AF1DA4760C5A8BB8BA7BA8C532F0068D770621CD2CC89E04C6
                                                                                                                                                                                                                                        SHA-512:93088745BA922918A8EBC20C7043DA4C3C639245547BE665D15625B7F808EC0BF120841ACEEFCE71134921EF8379821769DE35D32CCCC55E6B391C57C7F4D971
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...A..e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_MD4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.204576067987685
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:JsiHXqpwUiv6wPf+4WVrd1DFrXqwWwcqgfvE:36biio2Pd1DFrlgfvE
                                                                                                                                                                                                                                        MD5:D2131380B7760D5BC3C2E1772C747830
                                                                                                                                                                                                                                        SHA1:DA5838E1C6DF5EC45AC0963E98761E9188A064D0
                                                                                                                                                                                                                                        SHA-256:6DB786B30F6682CD699E22D0B06B873071DCC569557B6EB6EC1416689C0890FE
                                                                                                                                                                                                                                        SHA-512:594939FB1D9154E15106D4B4AA9EF51A6AE5062D471ED7C0779A8E3D84D8F4B1481529015E0926A3489119DA37BE6CFE70C70ED695A6E84F6AF8F65402F6AAB5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_MD5.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.4787123381499825
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:3Z9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZuRsP0rcqgjPrvE:SQ0gH7zSccA5J6ECTGmDMa89gjPrvE
                                                                                                                                                                                                                                        MD5:CAF687A7786892939FFF5D5B6730E069
                                                                                                                                                                                                                                        SHA1:96C2567A770E12C15903767A85ABF8AF57FE6D6A
                                                                                                                                                                                                                                        SHA-256:9001E0C50D77823D64C1891F12E02E77866B9EDE783CEF52ED4D01A32204781B
                                                                                                                                                                                                                                        SHA-512:0B3C9E5C1F7EF52E615D9E1E6F7D91324BAB7C97FFAFB6DBAEB229CF1B86420A3534493C34DD9FAEB4BBC3612F245248ABA34393311C31500D827538DFE24BC5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):18432
                                                                                                                                                                                                                                        Entropy (8bit):5.69653684522693
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:pkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+D0ngkov:2nx7RI26LuuHKz8+D5N
                                                                                                                                                                                                                                        MD5:9762DBF0527A46F21852CA5303E245C3
                                                                                                                                                                                                                                        SHA1:33333912F16BB755B0631D8308D94DA2D7589127
                                                                                                                                                                                                                                        SHA-256:0DF91D69B8D585D2660168125E407E3CB3D87F338B3628E5E0C2BF49C9D20DB8
                                                                                                                                                                                                                                        SHA-512:52687C38939710C90A8C97F2C465AF8CF0309E3939255427B88BC461E27FADA79B0CB31F8BD215F72B610CAC093934C066141B9298353F04CC067C4E68B31DF0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%.*... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA1.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):19456
                                                                                                                                                                                                                                        Entropy (8bit):5.798411671336839
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:cPHNP3MjevhSY/8EBbVxcJ0ihTLdFDUPHgj+kf4D:mPcKvr/jUJ0sbDoAj+t
                                                                                                                                                                                                                                        MD5:74DAAAB71F93BCE184D507A45A88985C
                                                                                                                                                                                                                                        SHA1:3D09D69E94548EC6975177B482B68F86EDA32BB8
                                                                                                                                                                                                                                        SHA-256:E781D6DAF2BAAA2C1A45BD1CDDB21BA491442D49A03255C1E367F246F17E13BF
                                                                                                                                                                                                                                        SHA-512:870EC2752304F12F2F91BE688A34812AC1C75D444A0107284E3C45987639D8D07116EB98DB76931F9C8487666E1B2C163FC5743BBFC5A72F20F040670CDEB509
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA224.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):5.86552932624144
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:V1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOhwgjxo:XjwyJUYToZwOLuzDNU1j
                                                                                                                                                                                                                                        MD5:92587A131875FF7DC137AA6195B8BD81
                                                                                                                                                                                                                                        SHA1:2BA642DDC869AB329893795704BFE3F23C7B6ECB
                                                                                                                                                                                                                                        SHA-256:D2A9484134A65EFF74F0BDA9BB94E19C4964B6C323667D68B4F45BB8A7D499FC
                                                                                                                                                                                                                                        SHA-512:62823A0168B415045A093ACC67E98B5E33908380860B04AA0568B04F39DE957DA30F929459C766DC9782EFC3143DCD2F4950E3876669E680B6910C213300B565
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...F..e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA256.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):5.867427817795374
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:b1jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNWegjxo:ZjwyJOYToZwOLuzDNW7j
                                                                                                                                                                                                                                        MD5:B4E18C9A88A241FD5136FAF33FB9C96A
                                                                                                                                                                                                                                        SHA1:077AF274AA0336880391E2F38C873A72BFC1DE3B
                                                                                                                                                                                                                                        SHA-256:E50DB07E18CB84827B0D55C7183CF580FB809673BCAFBCEF60E83B4899F3AA74
                                                                                                                                                                                                                                        SHA-512:81A059115627025A7BBF8743B48031619C13A513446B0D035AA25037E03B6A544E013CAAEB139B1BE9BA7D0D8CF28A5E7D4CD1B8E17948830E75BDFBD6AF1653
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...D..e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA384.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):27136
                                                                                                                                                                                                                                        Entropy (8bit):5.860145427724178
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:TFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDFfgjVx2:xDLh98jjRe+1WT1aAeIfMzxH2mDDqj
                                                                                                                                                                                                                                        MD5:34A0AD8A0EB6AC1E86DC8629944448ED
                                                                                                                                                                                                                                        SHA1:EF54E4C92C123BE341567A0ACC17E4CEE7B9F7A8
                                                                                                                                                                                                                                        SHA-256:03E93C2DCC19C3A0CDD4E8EFCDE90C97F6A819DFECF1C96495FDC7A0735FAA97
                                                                                                                                                                                                                                        SHA-512:A38EDE4B46DC9EFA80DFB6E019379809DF78A671F782660CD778427482B0F5987FA80A42C26FB367604BAFCD4FD21ABD1C833DAF2D4AEA3A43877F54D6906E21
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...G..e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_SHA512.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):27136
                                                                                                                                                                                                                                        Entropy (8bit):5.916758045478156
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:LFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXCElrgjhig:5YLB9Mgj0e+1WT1aAeIfMzx320DXR+j
                                                                                                                                                                                                                                        MD5:F028511CD5F2F925FD5A979152466CB4
                                                                                                                                                                                                                                        SHA1:38B8B44089B390E1F3AA952C950BDBE2CB69FBA5
                                                                                                                                                                                                                                        SHA-256:0FB591416CC9520C6D9C398E1EDF4B7DA412F80114F80628F84E9D4D37A64F69
                                                                                                                                                                                                                                        SHA-512:97C06A4DCEE7F05268D0A47F88424E28B063807FFBD94DABDCC3BF773AD933A549934916EB7339506624E97829AA5DC13321ADE31D528E8424FFDCF8C8407D4F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...I..e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):5.0002940201841
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:Dz/RF/1nb2mhQtk4axusjfkgZhoYDQmRjcqgQvEty:Dz/d2f64axnTTz5DTgQvEty
                                                                                                                                                                                                                                        MD5:87C1C89CEB6DF9F62A8F384474D27A4A
                                                                                                                                                                                                                                        SHA1:B0FC912A8DE5D9C18F603CD25AE3642185FFFBDD
                                                                                                                                                                                                                                        SHA-256:D2256A5F1D3DC6AE38B73EA2DB87735724D29CB400D00D74CF8D012E30903151
                                                                                                                                                                                                                                        SHA-512:C7DFB9C8E4F4AA984416BC84E829F0BB6CD87829C86BA259EE2A9BAB7C16B15362DB9EC87BF2ACED44A6BED7B1DE03DC9450665D083205B4CD4780DCF480DA01
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...K..e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.025717576776578
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:FF/1nb2mhQtks0iiNqdF4mtPjD0HA5APYcqgYvEL2x:R2f6fFA/4GjDucgYvEL2x
                                                                                                                                                                                                                                        MD5:20702216CDA3F967DF5C71FCE8B9B36F
                                                                                                                                                                                                                                        SHA1:4D9A814EE2941A175BC41F21283899D05831B488
                                                                                                                                                                                                                                        SHA-256:3F73F9D59EB028B7F17815A088CEB59A66D6784FEEF42F2DA08DD07DF917DD86
                                                                                                                                                                                                                                        SHA-512:0802CF05DAD26E6C5575BBECB419AF6C66E48ED878F4E18E9CEC4F78D6358D751D41D1F0CCB86770A46510B993B70D2B320675422A6620CE9843E2E42193DCD8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_keccak.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):16384
                                                                                                                                                                                                                                        Entropy (8bit):5.235441330454107
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:VTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gD/gvrjcqgCieT3WQ:VafgNpj9cHW3jqXeBRamD4ZgCieT
                                                                                                                                                                                                                                        MD5:F065FFB04F6CB9CDB149F3C66BC00216
                                                                                                                                                                                                                                        SHA1:B2BC4AF8A3E06255BAB15D1A8CF4A577523B03B6
                                                                                                                                                                                                                                        SHA-256:E263D7E722EC5200E219D6C7D8B7C1B18F923E103C44A0B5485436F7B778B7BD
                                                                                                                                                                                                                                        SHA-512:93E583B10D0F2BBB1D5539FF4E943A65BC67F6DFC51E5F991481574F58757F4D49A87022E551069F6FC55D690F7B1412CF5DE7DD9BEE27FB826853CE9ACC2B40
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...J..e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Hash\_poly1305.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.133851517560629
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:zZNGXEgvUh43G6coX2SSwmPL4V7wTdDlDaY2cqgWjvE:mVMhuGGF2L4STdDEYWgWjvE
                                                                                                                                                                                                                                        MD5:213AAEC146F365D950014D7FFF381B06
                                                                                                                                                                                                                                        SHA1:66FCD49E5B2278CD670367A4AC6704A59AE82B50
                                                                                                                                                                                                                                        SHA-256:CAF315A9353B2306880A58ECC5A1710BFE3AA35CFEAD7CF0528CAEE4A0629EAD
                                                                                                                                                                                                                                        SHA-512:0880D7D2B2C936A4B85E6C2A127B3509B76DB4751A3D8A7BB903229CABC8DE7A7F52888D67C886F606E21400DFC51C215D1CF9C976EB558EA70975412840883A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...K..e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Math\_modexp.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):35840
                                                                                                                                                                                                                                        Entropy (8bit):5.927928056434685
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:KbEkzS7+k9rMUb8cOe9rs9ja+V/Mhxh56GS:KbEP779rMtcOCs0I/Mjf
                                                                                                                                                                                                                                        MD5:732938D696EB507AF4C37795A4F9FCEA
                                                                                                                                                                                                                                        SHA1:FD585EA8779C305ADBE3574BE95CFD06C9BBD01C
                                                                                                                                                                                                                                        SHA-256:1383269169AB4D2312C52BF944BD5BB80A36D378FD634D7C1B8C3E1FFC0F0A8C
                                                                                                                                                                                                                                        SHA-512:E4EBC5470F3D05D79B65BC2752A7FF40F5525CD0813BDDECCB1042EE2286B733EE172383186E89361A49CBE0B4B14F8B2CBC0F32E475101385C634120BB36676
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.^...0......`.....................................................`..........................................~..|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.799297116284292
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:UkCfXASTMeAk4OepIXcADpOX6RcqgO5vE:+JMcPepIXcADq63gO5vE
                                                                                                                                                                                                                                        MD5:9E7B28D6AB7280BBB386C93EF490A7C1
                                                                                                                                                                                                                                        SHA1:B088F65F3F6E2B7D07DDBE86C991CCD33535EF09
                                                                                                                                                                                                                                        SHA-256:F84667B64D9BE1BCC6A91650ABCEE53ADF1634C02A8A4A8A72D8A772432C31E4
                                                                                                                                                                                                                                        SHA-512:16A6510B403BF7D9ED76A654D8C7E6A0C489B5D856C231D12296C9746AC51CD372CC60CA2B710606613F7BC056A588C54EA24F9C0DA3020BBEA43E43CEEB9CA4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...P..e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):754688
                                                                                                                                                                                                                                        Entropy (8bit):7.6249603206444005
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:l1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6hM:XYmzHoxJFf1p34hcrn5Go9yQO6q
                                                                                                                                                                                                                                        MD5:102898D47B45548E7F7E5ECC1D2D1FAA
                                                                                                                                                                                                                                        SHA1:DDAE3A3BDD8B83AF42126245F6CB24DC2202BC04
                                                                                                                                                                                                                                        SHA-256:C9BF3CF5707793C6026BFF68F2681FAAD29E953ED891156163CD0B44A3628A92
                                                                                                                                                                                                                                        SHA-512:85A42FC08C91AFF50A9FF196D6FE8ABD99124557341B9809B62A639957B166C2A7EFEA0A042BE2D753464DF5908DF4F5FE01A91C239B744CD44A70B79EF81048
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d...R..e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):27648
                                                                                                                                                                                                                                        Entropy (8bit):5.792776923715812
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:mBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsla15gkbQ0e1:cL/g28Ufsxg9GmvPauYLxtX1D8kf
                                                                                                                                                                                                                                        MD5:717DA232A3A9F0B94AF936B30B59D739
                                                                                                                                                                                                                                        SHA1:F1B3676E708696585FBCB742B863C5BB913D923F
                                                                                                                                                                                                                                        SHA-256:B3FD73D54079903C0BE39BA605ED9BB58ECD1D683CCB8821D0C0CC795165B0C6
                                                                                                                                                                                                                                        SHA-512:7AF46035F9D4A5786ED3CE9F97AC33637C3428EF7183DED2AFD380265FAE6969BB057E3B5D57C990DD083A9DB2A67BEA668D4215E78244D83D7EE7E0A7B40143
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d...R..e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):67072
                                                                                                                                                                                                                                        Entropy (8bit):6.060435635420756
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:YqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxROpq:YqctkGACFI5t35q2JbgrwwOoqLTM9rMq
                                                                                                                                                                                                                                        MD5:ADF96805C070920EA90D9AB4D1E35807
                                                                                                                                                                                                                                        SHA1:D8FA8E29D9CDCD678DC03DA527EAF2F0C3BEF21A
                                                                                                                                                                                                                                        SHA-256:A36B1EDC104136E12EB6F28BD9366D30FFCEC0434684DC139314723E9C549FB7
                                                                                                                                                                                                                                        SHA-512:FB67C1F86CF46A63DF210061D16418589CD0341A6AA75AB49F24F99AD3CFF874BB02664706B9E2C81B7EF7300AF5BB806C412B4F069D22B72F7D9EBFFF66FE61
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\PublicKey\_x25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.488514144301916
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:IpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADBhDTAbcX6gn/7EC:uVddiT7pgTctdErDDDTicqgn/7
                                                                                                                                                                                                                                        MD5:148E1600E9CBAF6702D62D023CAC60BC
                                                                                                                                                                                                                                        SHA1:4CDD8445408C4165B6E029B9966C71BC45E634A2
                                                                                                                                                                                                                                        SHA-256:1461AAFD4B9DC270128C89C3EB5358794C77693BB943DC7FC42AA3BB0FC52B16
                                                                                                                                                                                                                                        SHA-512:53155DA3FD754AF0BC30E2A51F0B579B8A83A772025CE0B4AFD01A31B8A40F46533FDA9CC3D0D32E9480DBBD7DD4A28F9DAAC11A370B0435E5E74666ACF9181C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d...R..e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.731194408014124
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:lJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGybMZYJWJcX6gbW6s:JVddiT7pgTctEEaEDKDuMCWJcqgbW6
                                                                                                                                                                                                                                        MD5:1547F8CB860AB6EA92B85D4C1B0209A1
                                                                                                                                                                                                                                        SHA1:C5AE217DEE073AC3D23C3BF72EE26D4C7515BD88
                                                                                                                                                                                                                                        SHA-256:1D2F3E627551753E58ED9A85F8D23716F03B51D8FB5394C4108EB1DC90DC9185
                                                                                                                                                                                                                                        SHA-512:40F0B46EE837E4568089D37709EF543A987411A17BDBAE93D8BA9F87804FB34DCA459A797629F34A5B3789B4D89BD46371AC4F00DDFE5D6B521DEA8DC2375115
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Cryptodome\Util\_strxor.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.686131723746002
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:EiZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DmWMoG4BcX6gbW6O:HVddiT7pgTctEEO3DcoHcqgbW6
                                                                                                                                                                                                                                        MD5:16F42DE194AAEFB2E3CDEE7FA63D2401
                                                                                                                                                                                                                                        SHA1:BE2AB72A90E0342457A9D13BE5B6B1984875EDEA
                                                                                                                                                                                                                                        SHA-256:61E23970B6CED494E11DC9DE9CB889C70B7FF7A5AFE5242BA8B29AA3DA7BC60E
                                                                                                                                                                                                                                        SHA-512:A671EA77BC8CA75AEDB26B73293B51B780E26D6B8046FE1B85AE12BC9CC8F1D2062F74DE79040AD44D259172F99781C7E774FE40768DC0A328BD82A48BF81489
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...P..e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Pythonwin\mfc140u.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5653536
                                                                                                                                                                                                                                        Entropy (8bit):6.729079283804055
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
                                                                                                                                                                                                                                        MD5:CD1D99DF975EE5395174DF834E82B256
                                                                                                                                                                                                                                        SHA1:F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
                                                                                                                                                                                                                                        SHA-256:D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
                                                                                                                                                                                                                                        SHA-512:397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\Pythonwin\win32ui.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1143296
                                                                                                                                                                                                                                        Entropy (8bit):6.0410832425584795
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:dk6co2gGIs7ZetrV6LMEsKK+Onc8fUqzFVVppS6yZAXz:dkG2QQetrgsK79qzFHL
                                                                                                                                                                                                                                        MD5:F0116137D0674482247D056642DC06BF
                                                                                                                                                                                                                                        SHA1:5BB63FCF5E569D94B61383D1921F758BCC48EF81
                                                                                                                                                                                                                                        SHA-256:8ECA3ED313003D3F3DEE1B7A5CE90B50E8477EC6E986E590E5ED91C919FC7564
                                                                                                                                                                                                                                        SHA-512:A8D6420C491766302C615E38DAF5D9B1698E5765125FD256530508E5C0A5675A7BF2F338A22368E0B4DDFA507D8D377507376C477CF9B829E28F3C399203CDE6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.K.K...K...K...3]..K..Y>...K.......K...3...K...>...K...>...K...>...K...K...M...>...K..Y>...K..Y>...K..Y>1..K..Y>...K..Rich.K..........................PE..d......g.........." .........r......4.....................................................`.........................................`....T..hr..h...............................l\......T.......................(.......8................0...........................text............................... ..`.rdata..|...........................@..@.data...............................@....pdata...............d..............@..@.rsrc...............................@..@.reloc..l\.......^..................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\VCRUNTIME140.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):109392
                                                                                                                                                                                                                                        Entropy (8bit):6.641929675972235
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
                                                                                                                                                                                                                                        MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
                                                                                                                                                                                                                                        SHA1:489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
                                                                                                                                                                                                                                        SHA-256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
                                                                                                                                                                                                                                        SHA-512:D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):49520
                                                                                                                                                                                                                                        Entropy (8bit):6.65700274508223
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
                                                                                                                                                                                                                                        MD5:7E668AB8A78BD0118B94978D154C85BC
                                                                                                                                                                                                                                        SHA1:DBAC42A02A8D50639805174AFD21D45F3C56E3A0
                                                                                                                                                                                                                                        SHA-256:E4B533A94E02C574780E4B333FCF0889F65ED00D39E32C0FBBDA2116F185873F
                                                                                                                                                                                                                                        SHA-512:72BB41DB17256141B06E2EAEB8FC65AD4ABDB65E4B5F604C82B9E7E7F60050734137D602E0F853F1A38201515655B6982F2761EE0FA77C531AA58591C95F0032
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d....J.$.........." ...".<...8.......A....................................................`A........................................0m.......m..x....................r..pO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_asyncio.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):65304
                                                                                                                                                                                                                                        Entropy (8bit):6.186523609819811
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:k2icaMc907zrzE6+gTKnEzhIVOnZC7SyMx6:k2icrc4HE6+gTOEzhIVOn0j
                                                                                                                                                                                                                                        MD5:CEE78DC603D57CB2117E03B2C0813D84
                                                                                                                                                                                                                                        SHA1:095C98CA409E364B8755DC9CFD12E6791BF6E2B8
                                                                                                                                                                                                                                        SHA-256:6306BE660D87FFB2271DD5D783EE32E735A792556E0B5BD672DC0B1C206FDADC
                                                                                                                                                                                                                                        SHA-512:7258560AA557E3E211BB9580ADD604B5191C769594E17800B2793239DF45225A82CE440A6B9DCF3F2228ED84712912AFFE9BF0B70B16498489832DF2DEE33E7E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:'T.[I..[I..[I..#...[I..'H..[I..'L..[I..'M..[I..'J..[I..&H..[I.M#H..[I..[H..[I..&D..[I..&I..[I..&...[I..&K..[I.Rich.[I.........PE..d......e.........." ...#.R..........`.....................................................`.............................................P...`...d......................../..........`w..T........................... v..@............p...............................text....P.......R.................. ..`.rdata..~J...p...L...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_brotli.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):820736
                                                                                                                                                                                                                                        Entropy (8bit):6.056263694016779
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:cY0Uu7wLsglBv4i5DGAqXMAHhlyL82XTw05nmZfR7o:cp0NA1tAmZfR
                                                                                                                                                                                                                                        MD5:D9FC15CAF72E5D7F9A09B675E309F71D
                                                                                                                                                                                                                                        SHA1:CD2B2465C04C713BC58D1C5DE5F8A2E13F900234
                                                                                                                                                                                                                                        SHA-256:1FCD75B03673904D9471EC03C0EF26978D25135A2026020E679174BDEF976DCF
                                                                                                                                                                                                                                        SHA-512:84F705D52BD3E50AC412C8DE4086C18100EAC33E716954FBCB3519F4225BE1F4E1C3643D5A777C76F7112FAE30CE428E0CE4C05180A52842DACB1F5514460006
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ls...........u......q......u......q......q......q.....Yq...........Hp.....Hp.....Hp.....Hp.....Rich............................PE..d......d.........." ...#.@...H.......F....................................................`.........................................@c..`....c.......................................9..............................P8..@............P...............................text....?.......@.................. ..`.rdata.......P.......D..............@..@.data........p.......`..............@....pdata...............h..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_bz2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):84760
                                                                                                                                                                                                                                        Entropy (8bit):6.56801864004604
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:7/Uez7qlMjca6uPZLPYMPHn3m8bhztpIVCVC7SyhJDxhy:4ezGC4TM/3RbhhpIVCVCXpy
                                                                                                                                                                                                                                        MD5:28EDE9CE9484F078AC4E52592A8704C7
                                                                                                                                                                                                                                        SHA1:BCF8D6FE9F42A68563B6CE964BDC615C119992D0
                                                                                                                                                                                                                                        SHA-256:403E76FE18515A5EA3227CF5F919AA2F32AC3233853C9FB71627F2251C554D09
                                                                                                                                                                                                                                        SHA-512:8C372F9F6C4D27F7CA9028C6034C17DEB6E98CFEF690733465C1B44BD212F363625D9C768F8E0BD4C781DDDE34EE4316256203ED18FA709D120F56DF3CCA108B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d......e.........." ...#.....^..............................................P.......U....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_cffi_backend.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):178176
                                                                                                                                                                                                                                        Entropy (8bit):6.165902427203749
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:87aw5iwiVHprp0+/aSdXUONX9dAXS7qkSTLkKh23/qZl:87kBVHplaSdRj4LkSTLLhW/q
                                                                                                                                                                                                                                        MD5:739D352BD982ED3957D376A9237C9248
                                                                                                                                                                                                                                        SHA1:961CF42F0C1BB9D29D2F1985F68250DE9D83894D
                                                                                                                                                                                                                                        SHA-256:9AEE90CF7980C8FF694BB3FFE06C71F87EB6A613033F73E3174A732648D39980
                                                                                                                                                                                                                                        SHA-512:585A5143519ED9B38BB53F912CEA60C87F7CE8BA159A1011CF666F390C2E3CC149E0AC601B008E039A0A78EAF876D7A3F64FFF612F5DE04C822C6E214BC2EFDE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A:.#.[.p.[.p.[.p.#.p.[.p..q.[.p..zp.[.p..q.[.p..q.[.p..q.[.pN#.q.[.pj.q.[.p.[.p.[.pM.q.[.p.#.p.[.pM.q.[.pM.xp.[.pM.q.[.pRich.[.p................PE..d......f.........." ...).....B............................................... ............`.........................................PX..l....X.......................................?...............................=..@............................................text...X........................... ..`.rdata..............................@..@.data....].......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_ctypes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):123672
                                                                                                                                                                                                                                        Entropy (8bit):6.0601189161591
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:aS7u5LnIxdP3fPHW+QfLIrAYKpemW9IVLPjo:aSw+3FQfLIrIemW3
                                                                                                                                                                                                                                        MD5:22C4892CAF560A3EE28CF7F210711F9E
                                                                                                                                                                                                                                        SHA1:B30520FADD882B667ECEF3B4E5C05DC92E08B95A
                                                                                                                                                                                                                                        SHA-256:E28D4E46E5D10B5FDCF0292F91E8FD767E33473116247CD5D577E4554D7A4C0C
                                                                                                                                                                                                                                        SHA-512:EDB86B3694FFF0B05318DECF7FC42C20C348C1523892CCE7B89CC9C5AB62925261D4DD72D9F46C9B2BDA5AC1E6B53060B8701318B064A286E84F817813960B19
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................).....).....).....).....O...............W.......c.O.....O.....O.o...O.....Rich..........................PE..d......e.........." ...#............p\..............................................jh....`.........................................pP.......P.........................../..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_decimal.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):253720
                                                                                                                                                                                                                                        Entropy (8bit):6.551075270762715
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:cjz3B48pj9aOtoQdpJOsoTiSi9qWM53pLW1Atp6tQh7:i94uj9afQVrom0bUQh7
                                                                                                                                                                                                                                        MD5:BAAA9067639597E63B55794A757DDEFF
                                                                                                                                                                                                                                        SHA1:E8DD6B03EBEF0B0A709E6CCCFF0E9F33C5142304
                                                                                                                                                                                                                                        SHA-256:6CD52B65E11839F417B212BA5A39F182B0151A711EBC7629DC260B532391DB72
                                                                                                                                                                                                                                        SHA-512:7995C3B818764AD88DB82148EA0CE560A0BBE9594CA333671B4C5E5C949F5932210EDBD63D4A0E0DC2DAF24737B99318E3D5DAAEE32A5478399A6AA1B9EE3719
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d......e.........." ...#.x...<......<...............................................:.....`......................................... T..P...pT..................$'......./......P.......T...........................P...@............................................text....v.......x.................. ..`.rdata..l............|..............@..@.data....*...p...$...T..............@....pdata..$'.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_hashlib.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):65304
                                                                                                                                                                                                                                        Entropy (8bit):6.2555709687934655
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:jfKlbLgy209/MkZy6n23JZlnvy7OjZophIVOIi7SyMrxZR1:7Khgy+XZla7OjSphIVOIiKR1
                                                                                                                                                                                                                                        MD5:C888ECC8298C36D498FF8919CEBDB4E6
                                                                                                                                                                                                                                        SHA1:F904E1832B9D9614FA1B8F23853B3E8C878D649D
                                                                                                                                                                                                                                        SHA-256:21D59958E2AD1B944C4811A71E88DE08C05C5CA07945192AB93DA5065FAC8926
                                                                                                                                                                                                                                        SHA-512:7161065608F34D6DE32F2C70B7485C4EE38CD3A41EF68A1BEACEE78E4C5B525D0C1347F148862CF59ABD9A4AD0026C2C2939736F4FC4C93E6393B3B53AA7C377
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(t..F'..F'..F'..'..F'u.G&..F'u.C&..F'u.B&..F'u.E&..F'..G&..F'..G&..F'..G'B.F'..K&..F'..F&..F'...'..F'..D&..F'Rich..F'................PE..d......e.........." ...#.T...~......@@..............................................H.....`............................................P... ............................/......X...P}..T............................|..@............p..0............................text....S.......T.................. ..`.rdata...O...p...P...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_lzma.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159000
                                                                                                                                                                                                                                        Entropy (8bit):6.849076584495919
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:cNltLBrdV/REWa/g7Lznf49mNoiUMApqlpIVZ1SXW:cNltPpREgAYOicMI
                                                                                                                                                                                                                                        MD5:D386B7C4DCF589E026ABFC7196CF1C4C
                                                                                                                                                                                                                                        SHA1:C07CE47CE0E69D233C5BDD0BCAC507057D04B2D4
                                                                                                                                                                                                                                        SHA-256:AD0440CA6998E18F5CC917D088AF3FEA2C0FF0FEBCE2B5E2B6C0F1370F6E87B1
                                                                                                                                                                                                                                        SHA-512:78D79E2379761B054DF1F9FD8C5B7DE5C16B99AF2D2DE16A3D0AC5CB3F0BD522257579A49E91218B972A273DB4981F046609FDCF2F31CF074724D544DAC7D6C8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T"#.5Lp.5Lp.5Lp.M.p.5Lp.IMq.5Lp.IIq.5Lp.IHq.5Lp.IOq.5LpnHMq.5Lp.MMq.5Lp.5Mp.5LpnHAq.5LpnHLq.5LpnH.p.5LpnHNq.5LpRich.5Lp................PE..d......e.........." ...#.b...........5....................................................`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text...na.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_multiprocessing.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):34584
                                                                                                                                                                                                                                        Entropy (8bit):6.408696570061904
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:n7I6Rwcl5w5zu8TdywGnJjRIVWtTk5YiSyvE+OAMxkEO:7Ikl5kzu8TdywGJjRIVWtTu7Sy18xK
                                                                                                                                                                                                                                        MD5:622A0E73779C88FC430B69CAF4A39789
                                                                                                                                                                                                                                        SHA1:F6536137E4E2CD8EC181F09B7DBA5E2E4D03B392
                                                                                                                                                                                                                                        SHA-256:EDFA9EE414F41448F8FFABB79F3BB8DB5C25E1CFD28FACF88EB5FE2D1E1D7551
                                                                                                                                                                                                                                        SHA-512:FD8D6DB53B630821845DFE22B09C4335565F848A421AF271797EFE272BAAA1EF887D735D4D5CD7D1258F2DD8F523327A67C071F7D16FC1BF53ACA39BAE41DFF2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-*.yCy.yCy.yCy...y.yCy'.Bx.yCy'.Fx.yCy'.Gx.yCy'.@x.yCyA.Bx.yCy.yBy.yCy..Bx.yCyA.Nx.yCyA.Cx.yCyA..y.yCyA.Ax.yCyRich.yCy................PE..d......e.........." ...#.....<......0...............................................E.....`.........................................0D..`....D..x....p.......`.......X.../...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_overlapped.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):50968
                                                                                                                                                                                                                                        Entropy (8bit):6.434106091606417
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:R1FMCcP4W9vqJKRJs2lNXSkCirb1IVXtW5YiSyvw5AMxkEfEk:R1FMaJKWkCg1IVXts7Sy4hxjEk
                                                                                                                                                                                                                                        MD5:D3BE208DC5388225162B6F88FF1D4386
                                                                                                                                                                                                                                        SHA1:8EFFDB606B6771D5FDF83145DE0F289E8AD83B69
                                                                                                                                                                                                                                        SHA-256:CE48969EBEBDC620F4313EBA2A6B6CDA568B663C09D5478FA93826D401ABE674
                                                                                                                                                                                                                                        SHA-512:9E1C3B37E51616687EECF1F7B945003F6EB4291D8794FEA5545B4A84C636007EB781C18F6436039DF02A902223AC73EFAC9B2E44DDC8594DB62FEB9997475DA3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}!{..O(..O(..O(.d.(..O(W`N)..O(W`J)..O(W`K)..O(W`L)..O(1aN)..O(..N(..O(.dN)..O(.dK)..O(1aB)..O(1aO)..O(1a.(..O(1aM)..O(Rich..O(................PE..d......e.........." ...#.B...X.......................................................N....`.........................................0...X................................/......,....f..T...........................Pe..@............`...............................text...fA.......B.................. ..`.rdata..$5...`...6...F..............@..@.data................|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_queue.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):32536
                                                                                                                                                                                                                                        Entropy (8bit):6.447318282610391
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:P0+yFg6rXtUmxU99IVQUT5YiSyvyxAMxkE44:c+wRXiWU99IVQUd7Sy+xE4
                                                                                                                                                                                                                                        MD5:50842CE7FCB1950B672D8A31C892A5D1
                                                                                                                                                                                                                                        SHA1:D84C69FA2110B860DA71785D1DBE868BD1A8320F
                                                                                                                                                                                                                                        SHA-256:06C36EC0749D041E6957C3CD7D2D510628B6ABE28CEE8C9728412D9CE196A8A2
                                                                                                                                                                                                                                        SHA-512:C1E686C112B55AB0A5E639399BD6C1D7ADFE6AEDC847F07C708BEE9F6F2876A1D8F41EDE9D5E5A88AC8A9FBB9F1029A93A83D1126619874E33D09C5A5E45A50D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:WX.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.L[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........PE..d......e.........." ...#.....8......................................................(F....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_socket.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):79640
                                                                                                                                                                                                                                        Entropy (8bit):6.28999572337647
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:YJlhpHrTT9r3ujE9/s+S+pzpCoiTFVf7p9IVLwg7SyLxU:Y7hpL13ujE9/sT+pz4oYFVTp9IVLwgo
                                                                                                                                                                                                                                        MD5:2C0EC225E35A0377AC1D0777631BFFE4
                                                                                                                                                                                                                                        SHA1:7E5D81A06FF8317AF52284AEDCCAC6EBACE5C390
                                                                                                                                                                                                                                        SHA-256:301C47C4016DAC27811F04F4D7232F24852EF7675E9A4500F0601703ED8F06AF
                                                                                                                                                                                                                                        SHA-512:AEA9D34D9E93622B01E702DEFD437D397F0E7642BC5F9829754D59860B345BBDE2DD6D7FE21CC1D0397FF0A9DB4ECFE7C38B649D33C5C6F0EAD233CB201A73E0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.+.".E.".E.".E.+...$.E...D. .E...@./.E...A.*.E...F.!.E...D. .E.".D...E.i.D.%.E...H.#.E...E.#.E....#.E...G.#.E.Rich".E.........................PE..d......e.........." ...#.l...........%.......................................P............`.............................................P............0....... ..x......../...@..........T...............................@............................................text...6k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_sqlite3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):120088
                                                                                                                                                                                                                                        Entropy (8bit):6.2579260754206505
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:vvtiqaiN2oSNMAwwi3CLl147ZvV9NdrRvdO5yFAuaUVMJF8MYRnchIVOQ1B:HJaiN2oSNVDD5FJFr2
                                                                                                                                                                                                                                        MD5:A70731AE2CA44B7292623AE8B0281549
                                                                                                                                                                                                                                        SHA1:9E086C0753BB43E2876C33C4872E71808932A744
                                                                                                                                                                                                                                        SHA-256:55344349F9199AEDAD1737A0311CBE2C3A4BF9494B76982520BACAD90F463C1B
                                                                                                                                                                                                                                        SHA-512:8334104DF9837D32946965290BBC46BA0A0ADA17BD2D03FC63380979F5FC86B26BE245636718B4304DFD0D85A5B3F7170614F148E5C965CC5ADF59D34465F7F1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`.g...g...g.......g.......g.....g.......g.......g.......g..q....g.......g...g...f..q....g..q....g..q..g..q....g..Rich.g..........................PE..d......e.........." ...#............................................................ G....`..........................................Z..P....Z.........................../..............T...........................p...@............................................text............................... ..`.rdata..l...........................@..@.data................n..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_ssl.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):176920
                                                                                                                                                                                                                                        Entropy (8bit):5.955624236034285
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:pjIQQSFBfL+SiSVWuXa6XzfBJ9d41Olh59YL48PMrN/WgAlNcLpIVC72a:CSFNL3LJa6Xzj4BLcLP
                                                                                                                                                                                                                                        MD5:66E78727C2DA15FD2AAC56571CD57147
                                                                                                                                                                                                                                        SHA1:E93C9A5E61DB000DEE0D921F55F8507539D2DF3D
                                                                                                                                                                                                                                        SHA-256:4727B60962EFACFD742DCA21341A884160CF9FCF499B9AFA3D9FDBCC93FB75D0
                                                                                                                                                                                                                                        SHA-512:A6881F9F5827ACEB51957AAED4C53B69FCF836F60B9FC66EEB2ED84AED08437A9F0B35EA038D4B1E3C539E350D9D343F8A6782B017B10A2A5157649ABBCA9F9A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.+.4.x.4.x.4.x.L)x.4.x.H.y.4.x.H.y.4.x.H.y.4.x.H.y.4.xiI.y.4.x.4.x>5.x.L.y.4.xiI.y.4.xiI.y.4.xiIEx.4.xiI.y.4.xRich.4.x................PE..d......e.........." ...#............l+...............................................!....`.........................................0...d................................/......|...P...T...............................@............................................text............................... ..`.rdata...".......$..................@..@.data...............................@....pdata...............\..............@..@.rsrc................h..............@..@.reloc..|............r..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\_uuid.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):25368
                                                                                                                                                                                                                                        Entropy (8bit):6.628339287223099
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:lCfwFpEWjfivQpIVZwobHQIYiSy1pCQFjzuAM+o/8E9VF0NySoJ:4qpEI4QpIVZwg5YiSyvgAMxkE7
                                                                                                                                                                                                                                        MD5:3A09B6DB7E4D6FF0F74C292649E4BA96
                                                                                                                                                                                                                                        SHA1:1A515F98946A4DCCC50579CBCEDF959017F3A23C
                                                                                                                                                                                                                                        SHA-256:FC09E40E569F472DD4BA2EA93DA48220A6B0387EC62BB0F41F13EF8FAB215413
                                                                                                                                                                                                                                        SHA-512:8D5EA9F7EEE3D75F0673CC7821A94C50F753299128F3D623E7A9C262788C91C267827C859C5D46314A42310C27699AF5CDFC6F7821DD38BF03C0B35873D9730F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<p.R#.R#.R#...#.R#i.S".R#i.W".R#i.V".R#i.Q".R#..S".R#..S".R#.S#..R#..Z".R#..R".R#...#.R#..P".R#Rich.R#........................PE..d......e.........." ...#.....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_helpers.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):51712
                                                                                                                                                                                                                                        Entropy (8bit):5.719745861304906
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:V1yQoUZM+e7B244LM1/sGFNUgOclIgD0iEXSmHN9D7KSDq/dFGlaKb+DzH:VloBBN4LM1/9FeiIyEXX9XKSEFAb+n
                                                                                                                                                                                                                                        MD5:ADD987AEC610B3D921DECBEF60E0DE8D
                                                                                                                                                                                                                                        SHA1:2763D5D3ACF58BC751323310F1F46ABCBC093C82
                                                                                                                                                                                                                                        SHA-256:AD5F49D13DDEA57319E9D404E8947B5207239D07D94332DFE601331A70A8D5EB
                                                                                                                                                                                                                                        SHA-512:D460AEA5256DE208CC0D13D59D05E809B3F5FD88C34731C776498113DA45B6FD732F00CC1C6E02B2F43992CBCD04598E48AEE140CA1C1E7FFDD3E8FF18238020
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.k...k...k....?..k......k.......k......k......k......k......k...k..Rk......k......k....S..k......k..Rich.k..........................PE..d..."B.g.........." ...).z...T.......|....................................... ............`.............................................`.......d...................................................................P...@............................................text...8y.......z.................. ..`.rdata...6.......6...~..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_http_parser.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):266240
                                                                                                                                                                                                                                        Entropy (8bit):6.171612984848152
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:BVuE3CWclftO4A1tgB9eIGnbQN4NFguNli5XURla2yBi2/1VDZoUyGRqpu:DV31clftOft+uNlQ/5isnKp
                                                                                                                                                                                                                                        MD5:57ABDBFC3F2020177909E20984032DD5
                                                                                                                                                                                                                                        SHA1:B814A1E284BF330F3387AFE0F1DC2CCF2B9B8016
                                                                                                                                                                                                                                        SHA-256:3A143C933FADD1A1A60A65BDD37858EA11D47A074F9A7934933B13C01B7C3B8B
                                                                                                                                                                                                                                        SHA-512:5CA9B1903E8AA7EA244A6807AC8107AD651AA6B16C444D420E9200D689D2A9FA9DAAC25BF937DEB9214CC0DD550E6F9231B4E8551AA0DC38D265A87B7DAE582E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B,6..MXY.MXY.MXY.5.Y.MXY..YX.MXYM5YX.MXYi.YX.MXY.MYY.MXY..[X.MXY..\X.MXY..]X.MXYN.PX.MXYN.XX.MXYN.Y.MXYN.ZX.MXYRich.MXY................PE..d..."B.g.........." ...).0...........1....................................................`.........................................p.......D...x....`.......@..0............p..\......................................@............@...............................text...X........0.................. ..`.rdata.."....@.......4..............@..@.data....F..........................@....pdata..0....@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_http_writer.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):49152
                                                                                                                                                                                                                                        Entropy (8bit):5.734133802541209
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:RuIpuGiOh9LHHQ2leaWYk/glLh2u+yBlhlr9iLr2F+HGlj55D2n8Ic:RuTGiK8a8Yl9z+yf9iH2F+H65B2n8Ic
                                                                                                                                                                                                                                        MD5:C5036E8B04879173F5E530F7B11C65BA
                                                                                                                                                                                                                                        SHA1:1F17B7551020575943B92058CC493B0C1A35D32C
                                                                                                                                                                                                                                        SHA-256:8D12BDD47DBABC836930A663A5149C4F2D2B9AE082F954EE26FE66D501FEBFE9
                                                                                                                                                                                                                                        SHA-512:07588B3E311ED1AEBD5BE0D96388FE180FED4629FE08EBCA4E86802B8AF3DAED603EABDB5AA427C2E5E80E384C5B3D859B0AC4438BD2A278E949DE6CE2FCE44B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..T.l...l...l....?..l......l..A....l......l......l......l..e...l...l...l..B...l..B...l..B.S..l..B...l..Rich.l..................PE..d...#B.g.........." ...).v...........x.......................................P............`.........................................p...h......d....0....... ..$............@......................................@...@...............X............................text...(u.......v.................. ..`.rdata...0.......2...z..............@..@.data...(N..........................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\aiohttp\_websocket.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36864
                                                                                                                                                                                                                                        Entropy (8bit):5.595737924373698
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:NTQTXEebmg5xAVNTTYMlam/Je5JAZ6cXu9lEQ/Yv8:hSP5KVV0MgF8G3/Yv
                                                                                                                                                                                                                                        MD5:EC9E2D8CC7966CACAC49DA5409BB72F7
                                                                                                                                                                                                                                        SHA1:EB0F500F21B7134EBC833CED27DF1450DB9EA241
                                                                                                                                                                                                                                        SHA-256:23391519E1BF052D4832ADA81BCA088C2B8BCE582F0EB3535109B524A2891E10
                                                                                                                                                                                                                                        SHA-512:FAA4A03CF4B0E7EB18412594F5199E57624099D4F53789BCD87CF2572F8F94636FADB8E99E3DEABBA57B2AB91427CDC7E239CF9D137D4EE3B31F6423E166F65B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.k...k...k....?..k......k.......k......k......k......k......k...k..rk......k......k....S..k......k..Rich.k..........................PE..d....B.g.........." ...).N...D...... P....................................................`..........................................|..d...t|..d...............4...................@s...............................r..@............`...............................text...xL.......N.................. ..`.rdata..:+...`...,...R..............@..@.data................~..............@....pdata..4...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-console-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22112
                                                                                                                                                                                                                                        Entropy (8bit):4.744270711412692
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:zFOhcWqhWpvWEXCVWQ4iWwklRxwVIX01k9z3AROVaz4ILS:zFlWqhWpk6R9zeU0J2
                                                                                                                                                                                                                                        MD5:E8B9D74BFD1F6D1CC1D99B24F44DA796
                                                                                                                                                                                                                                        SHA1:A312CFC6A7ED7BF1B786E5B3FD842A7EEB683452
                                                                                                                                                                                                                                        SHA-256:B1B3FD40AB437A43C8DB4994CCFFC7F88000CC8BB6E34A2BCBFF8E2464930C59
                                                                                                                                                                                                                                        SHA-512:B74D9B12B69DB81A96FC5A001FD88C1E62EE8299BA435E242C5CB2CE446740ED3D8A623E1924C2BC07BFD9AEF7B2577C9EC8264E53E5BE625F4379119BAFCC27
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....dZ..........." .........0...............................................@............`A........................................p...,............0...............0..`&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.602255667966723
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:NWqhWEWEXCVWQ4cRWvBQrVXC4dlgX01k9z3AUj7W6SxtR:NWqhWPlZVXC4deR9zVj7QR
                                                                                                                                                                                                                                        MD5:CFE0C1DFDE224EA5FED9BD5FF778A6E0
                                                                                                                                                                                                                                        SHA1:5150E7EDD1293E29D2E4D6BB68067374B8A07CE6
                                                                                                                                                                                                                                        SHA-256:0D0F80CBF476AF5B1C9FD3775E086ED0DFDB510CD0CC208EC1CCB04572396E3E
                                                                                                                                                                                                                                        SHA-512:B0E02E1F19CFA7DE3693D4D63E404BDB9D15527AC85A6D492DB1128BB695BFFD11BEC33D32F317A7615CB9A820CD14F9F8B182469D65AF2430FFCDBAD4BD7000
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....N7.........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.606873381830854
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:T0WqhWnWEXCVWQ4mW5ocADB6ZX01k9z3AkprGvV:T0WqhW8VcTR9zJpr4V
                                                                                                                                                                                                                                        MD5:33BBECE432F8DA57F17BF2E396EBAA58
                                                                                                                                                                                                                                        SHA1:890DF2DDDFDF3EECCC698312D32407F3E2EC7EB1
                                                                                                                                                                                                                                        SHA-256:7CF0944901F7F7E0D0B9AD62753FC2FE380461B1CCE8CDC7E9C9867C980E3B0E
                                                                                                                                                                                                                                        SHA-512:619B684E83546D97FC1D1BC7181AD09C083E880629726EE3AF138A9E4791A6DCF675A8DF65DC20EDBE6465B5F4EAC92A64265DF37E53A5F34F6BE93A5C2A7AE5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....IL..........." .........0...............................................@...........`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.65169290018864
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:qzmxD3T4qLWqhW2WJWadJCsVWQ4mW/xNVAv+cQ0GX01k9z3ARoanSwT44:qzQVWqhWTCsiNbZR9zQoUSwTJ
                                                                                                                                                                                                                                        MD5:EB0978A9213E7F6FDD63B2967F02D999
                                                                                                                                                                                                                                        SHA1:9833F4134F7AC4766991C918AECE900ACFBF969F
                                                                                                                                                                                                                                        SHA-256:AB25A1FE836FC68BCB199F1FE565C27D26AF0C390A38DA158E0D8815EFE1103E
                                                                                                                                                                                                                                        SHA-512:6F268148F959693EE213DB7D3DB136B8E3AD1F80267D8CBD7D5429C021ADACCC9C14424C09D527E181B9C9B5EA41765AFF568B9630E4EB83BFC532E56DFE5B63
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..H...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-file-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26216
                                                                                                                                                                                                                                        Entropy (8bit):4.866487428274293
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:gaNYPvVX8rFTsCWqhWVWEXCVWQ4mWPJlBLrp0KBQfX01k9z3ALkBw:WPvVX8WqhWiyBRxB+R9z2kBw
                                                                                                                                                                                                                                        MD5:EFAD0EE0136532E8E8402770A64C71F9
                                                                                                                                                                                                                                        SHA1:CDA3774FE9781400792D8605869F4E6B08153E55
                                                                                                                                                                                                                                        SHA-256:3D2C55902385381869DB850B526261DDEB4628B83E690A32B67D2E0936B2C6ED
                                                                                                                                                                                                                                        SHA-512:69D25EDF0F4C8AC5D77CB5815DFB53EAC7F403DC8D11BFE336A545C19A19FFDE1031FA59019507D119E4570DA0D79B95351EAC697F46024B4E558A0FF6349852
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....(............" .........@...............................................P......z.....`A........................................p................@...............@..h&..............p............................................................................rdata..|........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-file-l1-2-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.619913450163593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:iDGaWqhWhWJWadJCsVWQ4mWd9afKUSIX01k9z3AEXzAU9:i6aWqhWACs92IR9z5EU9
                                                                                                                                                                                                                                        MD5:1C58526D681EFE507DEB8F1935C75487
                                                                                                                                                                                                                                        SHA1:0E6D328FAF3563F2AAE029BC5F2272FB7A742672
                                                                                                                                                                                                                                        SHA-256:EF13DCE8F71173315DFC64AB839B033AB19A968EE15230E9D4D2C9D558EFEEE2
                                                                                                                                                                                                                                        SHA-512:8EDB9A0022F417648E2ECE9E22C96E2727976332025C3E7D8F15BCF6D7D97E680D1BF008EB28E2E0BD57787DCBB71D38B2DEB995B8EDC35FA6852AB1D593F3D1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....RS.........." .........0...............................................@......;.....`A........................................p...L............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-file-l2-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):18696
                                                                                                                                                                                                                                        Entropy (8bit):7.054510010549814
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
                                                                                                                                                                                                                                        MD5:BFFFA7117FD9B1622C66D949BAC3F1D7
                                                                                                                                                                                                                                        SHA1:402B7B8F8DCFD321B1D12FC85A1EE5137A5569B2
                                                                                                                                                                                                                                        SHA-256:1EA267A2E6284F17DD548C6F2285E19F7EDB15D6E737A55391140CE5CB95225E
                                                                                                                                                                                                                                        SHA-512:B319CC7B436B1BE165CDF6FFCAB8A87FE29DE78F7E0B14C8F562BE160481FB5483289BD5956FDC1D8660DA7A3F86D8EEDE35C6CC2B7C3D4C852DECF4B2DCDB7F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0............`.........................................`................ ...................=..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.625331165566263
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:qzWqhWxWJWadJCsVWQ4mW8RJLNVAv+cQ0GX01k9z3ARo8ef3uBJu:qzWqhWwCsjNbZR9zQoEzu
                                                                                                                                                                                                                                        MD5:E89CDCD4D95CDA04E4ABBA8193A5B492
                                                                                                                                                                                                                                        SHA1:5C0AEE81F32D7F9EC9F0650239EE58880C9B0337
                                                                                                                                                                                                                                        SHA-256:1A489E0606484BD71A0D9CB37A1DC6CA8437777B3D67BFC8C0075D0CC59E6238
                                                                                                                                                                                                                                        SHA-512:55D01E68C8C899E99A3C62C2C36D6BCB1A66FF6ECD2636D2D0157409A1F53A84CE5D6F0C703D5ED47F8E9E2D1C9D2D87CC52585EE624A23D92183062C999B97E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....Hb..........." .........0...............................................@............`A........................................p...`............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.737397647066978
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:OdxlZWqhWcWJWadJCsVWQ4mWlhtFyttuX01k9z3A2oD:OdxlZWqhWpCsctkSR9zfoD
                                                                                                                                                                                                                                        MD5:ACCC640D1B06FB8552FE02F823126FF5
                                                                                                                                                                                                                                        SHA1:82CCC763D62660BFA8B8A09E566120D469F6AB67
                                                                                                                                                                                                                                        SHA-256:332BA469AE84AA72EC8CCE2B33781DB1AB81A42ECE5863F7A3CB5A990059594F
                                                                                                                                                                                                                                        SHA-512:6382302FB7158FC9F2BE790811E5C459C5C441F8CAEE63DF1E09B203B8077A27E023C4C01957B252AC8AC288F8310BCEE5B4DCC1F7FC691458B90CDFAA36DCBE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....B.l.........." .........0...............................................@.......A....`A........................................p................0...............0..x&..............p............................................................................rdata..|...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.6569647133331316
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dwWqhWWWEXCVWQ4mWLnySfKUSIX01k9z3AEXz5SLaDa3:iWqhWJhY2IR9z5YLt3
                                                                                                                                                                                                                                        MD5:C6024CC04201312F7688A021D25B056D
                                                                                                                                                                                                                                        SHA1:48A1D01AE8BC90F889FB5F09C0D2A0602EE4B0FD
                                                                                                                                                                                                                                        SHA-256:8751D30DF554AF08EF42D2FAA0A71ABCF8C7D17CE9E9FF2EA68A4662603EC500
                                                                                                                                                                                                                                        SHA-512:D86C773416B332945ACBB95CBE90E16730EF8E16B7F3CCD459D7131485760C2F07E95951AEB47C1CF29DE76AFFEB1C21BDF6D8260845E32205FE8411ED5EFA47
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...}.o..........." .........0...............................................@......v.....`A........................................p................0...............0..h&..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.882042129450427
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:9TvuBL3BBLAWqhWUWEXCVWQ4iWgdCLVx6RMySX01k9z3AzaXQ+BB:9TvuBL3BaWqhW/WSMR9zqaP
                                                                                                                                                                                                                                        MD5:1F2A00E72BC8FA2BD887BDB651ED6DE5
                                                                                                                                                                                                                                        SHA1:04D92E41CE002251CC09C297CF2B38C4263709EA
                                                                                                                                                                                                                                        SHA-256:9C8A08A7D40B6F697A21054770F1AFA9FFB197F90EF1EEE77C67751DF28B7142
                                                                                                                                                                                                                                        SHA-512:8CF72DF019F9FC9CD22FF77C37A563652BECEE0708FF5C6F1DA87317F41037909E64DCBDCC43E890C5777E6BCFA4035A27AFC1AEEB0F5DEBA878E3E9AEF7B02A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....g..........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):5.355894399765837
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:0naOMw3zdp3bwjGzue9/0jCRrndbnWqhW5lFydVXC4deR9zVj7xR:FOMwBprwjGzue9/0jCRrndbtGydVXC4O
                                                                                                                                                                                                                                        MD5:724223109E49CB01D61D63A8BE926B8F
                                                                                                                                                                                                                                        SHA1:072A4D01E01DBBAB7281D9BD3ADD76F9A3C8B23B
                                                                                                                                                                                                                                        SHA-256:4E975F618DF01A492AE433DFF0DD713774D47568E44C377CEEF9E5B34AAD1210
                                                                                                                                                                                                                                        SHA-512:19B0065B894DC66C30A602C9464F118E7F84D83010E74457D48E93AACA4422812B093B15247B24D5C398B42EF0319108700543D13F156067B169CCFB4D7B6B7C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...0.&3.........." .........0...............................................@......L0....`A........................................p................0...............0..h&..............p............................................................................rdata..D...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.771309314175772
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:L0WqhWTWEXCVWQ4cRWdmjKDUX01k9z3AQyMX/7kn:L0WqhWol1pR9zzDY
                                                                                                                                                                                                                                        MD5:3C38AAC78B7CE7F94F4916372800E242
                                                                                                                                                                                                                                        SHA1:C793186BCF8FDB55A1B74568102B4E073F6971D6
                                                                                                                                                                                                                                        SHA-256:3F81A149BA3862776AF307D5C7FEEF978F258196F0A1BF909DA2D3F440FF954D
                                                                                                                                                                                                                                        SHA-512:C2746AA4342C6AFFFBD174819440E1BBF4371A7FED29738801C75B49E2F4F94FD6D013E002BAD2AADAFBC477171B8332C8C5579D624684EF1AFBFDE9384B8588
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...`.@f.........." .........0...............................................@......K.....`A........................................p...l............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.7115212149950185
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:bWqhWUxWJWadJCsVWQ4mW5iFyttuX01k9z3A2EC:bWqhWUwCs8SR9zfEC
                                                                                                                                                                                                                                        MD5:321A3CA50E80795018D55A19BF799197
                                                                                                                                                                                                                                        SHA1:DF2D3C95FB4CBB298D255D342F204121D9D7EF7F
                                                                                                                                                                                                                                        SHA-256:5476DB3A4FECF532F96D48F9802C966FDEF98EC8D89978A79540CB4DB352C15F
                                                                                                                                                                                                                                        SHA-512:3EC20E1AC39A98CB5F726D8390C2EE3CD4CD0BF118FDDA7271F7604A4946D78778713B675D19DD3E1EC1D6D4D097ABE9CD6D0F76B3A7DFF53CE8D6DBC146870A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...j............" .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.893761152454321
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dEFP2WqhWVWEXCVWQ4mW68vx6RMySX01k9z3AzapOP:eF+WqhWi6gMR9zqa0
                                                                                                                                                                                                                                        MD5:0462E22F779295446CD0B63E61142CA5
                                                                                                                                                                                                                                        SHA1:616A325CD5B0971821571B880907CE1B181126AE
                                                                                                                                                                                                                                        SHA-256:0B6B598EC28A9E3D646F2BB37E1A57A3DDA069A55FBA86333727719585B1886E
                                                                                                                                                                                                                                        SHA-512:07B34DCA6B3078F7D1E8EDE5C639F697C71210DCF9F05212FD16EB181AB4AC62286BC4A7CE0D84832C17F5916D0224D1E8AAB210CEEFF811FC6724C8845A74FE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...L.Y..........." .........0...............................................@............`A........................................p...H............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):5.231196901820079
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:/Mck1JzX9cKSI0WqhWsWJWadJCsVWQ4mWClLeyttuX01k9z3A2XCJq:Uck1JzNcKSI0WqhWZCsvfSR9zfyk
                                                                                                                                                                                                                                        MD5:C3632083B312C184CBDD96551FED5519
                                                                                                                                                                                                                                        SHA1:A93E8E0AF42A144009727D2DECB337F963A9312E
                                                                                                                                                                                                                                        SHA-256:BE8D78978D81555554786E08CE474F6AF1DE96FCB7FA2F1CE4052BC80C6B2125
                                                                                                                                                                                                                                        SHA-512:8807C2444A044A3C02EF98CF56013285F07C4A1F7014200A21E20FCB995178BA835C30AC3889311E66BC61641D6226B1FF96331B019C83B6FCC7C87870CCE8C4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....O.j.........." .........0...............................................@......9&....`A........................................p................0...............0..x&..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.799245167892134
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:R0DfIeUWqhWLWJWadJCsVWQ4mWFVyttuX01k9z3A2YHmp:R0DfIeUWqhWiCsLSR9zfYHmp
                                                                                                                                                                                                                                        MD5:517EB9E2CB671AE49F99173D7F7CE43F
                                                                                                                                                                                                                                        SHA1:4CCF38FED56166DDBF0B7EFB4F5314C1F7D3B7AB
                                                                                                                                                                                                                                        SHA-256:57CC66BF0909C430364D35D92B64EB8B6A15DC201765403725FE323F39E8AC54
                                                                                                                                                                                                                                        SHA-512:492BE2445B10F6BFE6C561C1FC6F5D1AF6D1365B7449BC57A8F073B44AE49C88E66841F5C258B041547FCD33CBDCB4EB9DD3E24F0924DB32720E51651E9286BE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....#..........." .........0...............................................@.......,....`A........................................p................0...............0..x&..............p............................................................................rdata..\...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.587063911311469
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:fWqhWeWJWadJCsVWQ4mWMs7DENNVAv+cQ0GX01k9z3ARoIGA/:fWqhWbCs8oNbZR9zQoxS
                                                                                                                                                                                                                                        MD5:F3FF2D544F5CD9E66BFB8D170B661673
                                                                                                                                                                                                                                        SHA1:9E18107CFCD89F1BBB7FDAF65234C1DC8E614ADD
                                                                                                                                                                                                                                        SHA-256:E1C5D8984A674925FA4AFBFE58228BE5323FE5123ABCD17EC4160295875A625F
                                                                                                                                                                                                                                        SHA-512:184B09C77D079127580EF80EB34BDED0F5E874CEFBE1C5F851D86861E38967B995D859E8491FCC87508930DC06C6BBF02B649B3B489A1B138C51A7D4B4E7AAAD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......e.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..P...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.754374422741657
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:CGeVPWqhWUWJWadJCsVWQ4mWUhSqyttuX01k9z3A2lqn7cq:CGeVPWqhWBCsvoSR9zflBq
                                                                                                                                                                                                                                        MD5:A0C2DBE0F5E18D1ADD0D1BA22580893B
                                                                                                                                                                                                                                        SHA1:29624DF37151905467A223486500ED75617A1DFD
                                                                                                                                                                                                                                        SHA-256:3C29730DF2B28985A30D9C82092A1FAA0CEB7FFC1BD857D1EF6324CF5524802F
                                                                                                                                                                                                                                        SHA-512:3E627F111196009380D1687E024E6FFB1C0DCF4DCB27F8940F17FEC7EFDD8152FF365B43CB7FDB31DE300955D6C15E40A2C8FB6650A91706D7EA1C5D89319B12
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......Z.........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-string-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.664553499673792
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:mZyMvr5WqhWAWJWadJCsVWQ4mWWqpNVAv+cQ0GX01k9z3ARo+GZ:mZyMvlWqhWNCsUpNbZR9zQo+GZ
                                                                                                                                                                                                                                        MD5:2666581584BA60D48716420A6080ABDA
                                                                                                                                                                                                                                        SHA1:C103F0EA32EBBC50F4C494BCE7595F2B721CB5AD
                                                                                                                                                                                                                                        SHA-256:27E9D3E7C8756E4512932D674A738BF4C2969F834D65B2B79C342A22F662F328
                                                                                                                                                                                                                                        SHA-512:BEFED15F11A0550D2859094CC15526B791DADEA12C2E7CEB35916983FB7A100D89D638FB1704975464302FAE1E1A37F36E01E4BEF5BC4924AB8F3FD41E60BD0C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....I..........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..l...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):5.146069394118203
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:vUwidv3V0dfpkXc0vVaCsWqhWjCsa2IR9z5Bk5l:sHdv3VqpkXc0vVaP+U9zzk5l
                                                                                                                                                                                                                                        MD5:225D9F80F669CE452CA35E47AF94893F
                                                                                                                                                                                                                                        SHA1:37BD0FFC8E820247BD4DB1C36C3B9F9F686BBD50
                                                                                                                                                                                                                                        SHA-256:61C0EBE60CE6EBABCB927DDFF837A9BF17E14CD4B4C762AB709E630576EC7232
                                                                                                                                                                                                                                        SHA-512:2F71A3471A9868F4D026C01E4258AFF7192872590F5E5C66AABD3C088644D28629BA8835F3A4A23825631004B1AFD440EFE7161BB9FC7D7C69E0EE204813CA7B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....x.........." .........0...............................................@.......J....`A........................................p...X............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.834520503429805
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:etZ3xWqhWqWJWadJCsVWQ4mWfH/fKUSIX01k9z3AEXz40OY:etZ3xWqhWHCsMH2IR9z5OY
                                                                                                                                                                                                                                        MD5:1281E9D1750431D2FE3B480A8175D45C
                                                                                                                                                                                                                                        SHA1:BC982D1C750B88DCB4410739E057A86FF02D07EF
                                                                                                                                                                                                                                        SHA-256:433BD8DDC4F79AEE65CA94A54286D75E7D92B019853A883E51C2B938D2469BAA
                                                                                                                                                                                                                                        SHA-512:A954E6CE76F1375A8BEAC51D751B575BBC0B0B8BA6AA793402B26404E45718165199C2C00CCBCBA3783C16BDD96F0B2C17ADDCC619C39C8031BECEBEF428CE77
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@.......w....`A........................................p...x............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.916367637528538
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:qaIMFSYWqhWzWJWadJCsVWQ4mW14LyttuX01k9z3A2ClV:qdYWqhWqCsISR9zfCT
                                                                                                                                                                                                                                        MD5:FD46C3F6361E79B8616F56B22D935A53
                                                                                                                                                                                                                                        SHA1:107F488AD966633579D8EC5EB1919541F07532CE
                                                                                                                                                                                                                                        SHA-256:0DC92E8830BC84337DCAE19EF03A84EF5279CF7D4FDC2442C1BC25320369F9DF
                                                                                                                                                                                                                                        SHA-512:3360B2E2A25D545CCD969F305C4668C6CDA443BBDBD8A8356FFE9FBC2F70D90CF4540F2F28C9ED3EEA6C9074F94E69746E7705E6254827E6A4F158A75D81065B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...~.l-.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.829681745003914
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:HNpWqhW5WJWadJCsVWQ4mWbZyttuX01k9z3A2qkFU:HXWqhW4Cs1SR9zf9U
                                                                                                                                                                                                                                        MD5:D12403EE11359259BA2B0706E5E5111C
                                                                                                                                                                                                                                        SHA1:03CC7827A30FD1DEE38665C0CC993B4B533AC138
                                                                                                                                                                                                                                        SHA-256:F60E1751A6AC41F08E46480BF8E6521B41E2E427803996B32BDC5E78E9560781
                                                                                                                                                                                                                                        SHA-512:9004F4E59835AF57F02E8D9625814DB56F0E4A98467041DA6F1367EF32366AD96E0338D48FFF7CC65839A24148E2D9989883BCDDC329D9F4D27CAE3F843117D0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...>.os.........." .........0...............................................@............`A........................................p...H............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-core-util-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.612408827336625
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:CWqhW+WJWadJCsVWQ4mWprgfKUSIX01k9z3AEXzh:CWqhW7Cs12IR9z5F
                                                                                                                                                                                                                                        MD5:0F129611A4F1E7752F3671C9AA6EA736
                                                                                                                                                                                                                                        SHA1:40C07A94045B17DAE8A02C1D2B49301FAD231152
                                                                                                                                                                                                                                        SHA-256:2E1F090ABA941B9D2D503E4CD735C958DF7BB68F1E9BDC3F47692E1571AAAC2F
                                                                                                                                                                                                                                        SHA-512:6ABC0F4878BB302713755A188F662C6FE162EA6267E5E1C497C9BA9FDDBDAEA4DB050E322CB1C77D6638ECF1DAD940B9EBC92C43ACAA594040EE58D313CBCFAE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....+..........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.918215004381039
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:OvMWqhWkWJWadJCsVWQ4mWoz/HyttuX01k9z3A21O:JWqhWxCs/SSR9zf1O
                                                                                                                                                                                                                                        MD5:D4FBA5A92D68916EC17104E09D1D9D12
                                                                                                                                                                                                                                        SHA1:247DBC625B72FFB0BF546B17FB4DE10CAD38D495
                                                                                                                                                                                                                                        SHA-256:93619259328A264287AEE7C5B88F7F0EE32425D7323CE5DC5A2EF4FE3BED90D5
                                                                                                                                                                                                                                        SHA-512:D5A535F881C09F37E0ADF3B58D41E123F527D081A1EBECD9A927664582AE268341771728DC967C30908E502B49F6F853EEAEBB56580B947A629EDC6BCE2340D8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Aj............" .........0...............................................@......UJ....`A.........................................................0...............0..x&..............p............................................................................rdata..p...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26216
                                                                                                                                                                                                                                        Entropy (8bit):4.882777558752248
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:I9cy5WqhWKWEXCVWQ4mW1pbm6yttuX01k9z3A2jyM:Ry5WqhWdcbmLSR9zfjj
                                                                                                                                                                                                                                        MD5:EDF71C5C232F5F6EF3849450F2100B54
                                                                                                                                                                                                                                        SHA1:ED46DA7D59811B566DD438FA1D09C20F5DC493CE
                                                                                                                                                                                                                                        SHA-256:B987AB40CDD950EBE7A9A9176B80B8FFFC005CCD370BB1CBBCAD078C1A506BDC
                                                                                                                                                                                                                                        SHA-512:481A3C8DC5BEF793EE78CE85EC0F193E3E9F6CD57868B813965B312BD0FADEB5F4419707CD3004FBDB407652101D52E061EF84317E8BD458979443E9F8E4079A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...U.gJ.........." .........@...............................................P............`A.........................................................@...............@..h&..............p............................................................................rdata..n........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.738587310329139
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:TWqhWXWEXCVWQ4mWPXTNyttuX01k9z3A2dGxr:TWqhWMKASR9zfYxr
                                                                                                                                                                                                                                        MD5:F9235935DD3BA2AA66D3AA3412ACCFBF
                                                                                                                                                                                                                                        SHA1:281E548B526411BCB3813EB98462F48FFAF4B3EB
                                                                                                                                                                                                                                        SHA-256:2F6BD6C235E044755D5707BD560A6AFC0BA712437530F76D11079D67C0CF3200
                                                                                                                                                                                                                                        SHA-512:AD0C0A7891FB8328F6F0CF1DDC97523A317D727C15D15498AFA53C07610210D2610DB4BC9BD25958D47ADC1AF829AD4D7CF8AABCAB3625C783177CCDB7714246
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...9.4o.........." .........0...............................................@......h*....`A............................................"............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):5.202163846121633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:2pUEpnWlC0i5CBWqhWXLeWEXCVWQ4iW+/x6RMySX01k9z3Aza8Az629:2ptnWm5CBWqhWtWMR9zqaH629
                                                                                                                                                                                                                                        MD5:5107487B726BDCC7B9F7E4C2FF7F907C
                                                                                                                                                                                                                                        SHA1:EBC46221D3C81A409FAB9815C4215AD5DA62449C
                                                                                                                                                                                                                                        SHA-256:94A86E28E829276974E01F8A15787FDE6ED699C8B9DC26F16A51765C86C3EADE
                                                                                                                                                                                                                                        SHA-512:A0009B80AD6A928580F2B476C1BDF4352B0611BB3A180418F2A42CFA7A03B9F0575ED75EC855D30B26E0CCA96A6DA8AFFB54862B6B9AFF33710D2F3129283FAA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......M4....`A.........................................................0...............0..h&..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.866983142029453
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:0vh8Y17aFBRsWqhW9AWEXCVWQ4mWCB4Lrp0KBQfX01k9z3ALkg5Z7:SL5WqhW9boRxB+R9z2kM7
                                                                                                                                                                                                                                        MD5:D5D77669BD8D382EC474BE0608AFD03F
                                                                                                                                                                                                                                        SHA1:1558F5A0F5FACC79D3957FF1E72A608766E11A64
                                                                                                                                                                                                                                        SHA-256:8DD9218998B4C4C9E8D8B0F8B9611D49419B3C80DAA2F437CBF15BCFD4C0B3B8
                                                                                                                                                                                                                                        SHA-512:8DEFA71772105FD9128A669F6FF19B6FE47745A0305BEB9A8CADB672ED087077F7538CD56E39329F7DAA37797A96469EAE7CD5E4CCA57C9A183B35BDC44182F3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...."]..........." .........0...............................................@............`A.........................................................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.828044267819929
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:dUnWqhWRWJWadJCsVWQ4mW+2PyttuX01k9z3A23y:cWqhWQCsHSR9zf3y
                                                                                                                                                                                                                                        MD5:650435E39D38160ABC3973514D6C6640
                                                                                                                                                                                                                                        SHA1:9A5591C29E4D91EAA0F12AD603AF05BB49708A2D
                                                                                                                                                                                                                                        SHA-256:551A34C400522957063A2D71FA5ABA1CD78CC4F61F0ACE1CD42CC72118C500C0
                                                                                                                                                                                                                                        SHA-512:7B4A8F86D583562956593D27B7ECB695CB24AB7192A94361F994FADBA7A488375217755E7ED5071DE1D0960F60F255AA305E9DD477C38B7BB70AC545082C9D5E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...6..q.........." .........0...............................................@.......-....`A............................................e............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):30328
                                                                                                                                                                                                                                        Entropy (8bit):5.14173409150951
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:r7yaFM4Oe59Ckb1hgmLVWqhW2CsWNbZR9zQoekS:/FMq59Bb1jnoFT9zGp
                                                                                                                                                                                                                                        MD5:B8F0210C47847FC6EC9FBE2A1AD4DEBB
                                                                                                                                                                                                                                        SHA1:E99D833AE730BE1FEDC826BF1569C26F30DA0D17
                                                                                                                                                                                                                                        SHA-256:1C4A70A73096B64B536BE8132ED402BCFB182C01B8A451BFF452EFE36DDF76E7
                                                                                                                                                                                                                                        SHA-512:992D790E18AC7AE33958F53D458D15BFF522A3C11A6BD7EE2F784AC16399DE8B9F0A7EE896D9F2C96D1E2C8829B2F35FF11FC5D8D1B14C77E22D859A1387797C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................" .........P...............................................`............`A.............................................%...........P...............P..x&..............p............................................................................rdata...'.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-multibyte-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):30312
                                                                                                                                                                                                                                        Entropy (8bit):4.96699982894665
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:PfhhvLPmIHJI6/CpG3t2G3t4odXLVWqhW2ntNbZR9zQo9eZ:xhPmIHJI69VFT9zO
                                                                                                                                                                                                                                        MD5:075419431D46DC67932B04A8B91A772F
                                                                                                                                                                                                                                        SHA1:DB2AF49EE7B6BEC379499B5A80BE39310C6C8425
                                                                                                                                                                                                                                        SHA-256:3A4B66E65A5EE311AFC37157A8101ABA6017FF7A4355B4DD6E6C71D5B7223560
                                                                                                                                                                                                                                        SHA-512:76287E0003A396CDA84CE6B206986476F85E927A389787D1D273684167327C41FC0FE5E947175C0DEB382C5ACCF785F867D9FCE1FEA4ABD7D99B201E277D1704
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Y.g..........." .........P...............................................`.......r....`A............................................. ...........P...............P..h&..............p............................................................................rdata..t".......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-process-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):4.883012715268179
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5eXrqjd7ZWqhW3WEXCVWQ4mW3Ql1Lrp0KBQfX01k9z3ALkjY/12:54rgWqhWsP1RxB+R9z2kjY/Y
                                                                                                                                                                                                                                        MD5:272C0F80FD132E434CDCDD4E184BB1D8
                                                                                                                                                                                                                                        SHA1:5BC8B7260E690B4D4039FE27B48B2CECEC39652F
                                                                                                                                                                                                                                        SHA-256:BD943767F3E0568E19FB52522217C22B6627B66A3B71CD38DD6653B50662F39D
                                                                                                                                                                                                                                        SHA-512:94892A934A92EF1630FBFEA956D1FE3A3BFE687DEC31092828960968CB321C4AB3AF3CAF191D4E28C8CA6B8927FBC1EC5D17D5C8A962C848F4373602EC982CD4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...<SdT.........." .........0...............................................@......N.....`A............................................x............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-runtime-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26208
                                                                                                                                                                                                                                        Entropy (8bit):5.023753175006074
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:4mGqX8mPrpJhhf4AN5/KiFWqhWyzWEXCVWQ4OW4034hHssDX01k9z3AaYX2cWo:4ysyr77WqhWyI0oFDR9z9YH9
                                                                                                                                                                                                                                        MD5:20C0AFA78836B3F0B692C22F12BDA70A
                                                                                                                                                                                                                                        SHA1:60BB74615A71BD6B489C500E6E69722F357D283E
                                                                                                                                                                                                                                        SHA-256:962D725D089F140482EE9A8FF57F440A513387DD03FDC06B3A28562C8090C0BC
                                                                                                                                                                                                                                        SHA-512:65F0E60136AB358661E5156B8ECD135182C8AAEFD3EC320ABDF9CFC8AEAB7B68581890E0BBC56BAD858B83D47B7A0143FA791195101DC3E2D78956F591641D16
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....TR.........." .........@...............................................P......D!....`A............................................4............@...............@..`&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-stdio-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26232
                                                                                                                                                                                                                                        Entropy (8bit):5.289041983400337
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:UuV2OlkuWYFxEpahfWqhWNWJWadJCsVWQ4mWeX9UfKUSIX01k9z3AEXzGd5S:dV2oFVhfWqhWMCstE2IR9z5Sd5S
                                                                                                                                                                                                                                        MD5:96498DC4C2C879055A7AFF2A1CC2451E
                                                                                                                                                                                                                                        SHA1:FECBC0F854B1ADF49EF07BEACAD3CEC9358B4FB2
                                                                                                                                                                                                                                        SHA-256:273817A137EE049CBD8E51DC0BB1C7987DF7E3BF4968940EE35376F87EF2EF8D
                                                                                                                                                                                                                                        SHA-512:4E0B2EF0EFE81A8289A447EB48898992692FEEE4739CEB9D87F5598E449E0059B4E6F4EB19794B9DCDCE78C05C8871264797C14E4754FD73280F37EC3EA3C304
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...k. U.........." .........@...............................................P............`A............................................a............@...............@..x&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26232
                                                                                                                                                                                                                                        Entropy (8bit):5.284932479906984
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:tCLx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWqhWbQCsMSR9zful:tCV5yguNvZ5VQgx3SbwA71IkFGqHe9zI
                                                                                                                                                                                                                                        MD5:115E8275EB570B02E72C0C8A156970B3
                                                                                                                                                                                                                                        SHA1:C305868A014D8D7BBEF9ABBB1C49A70E8511D5A6
                                                                                                                                                                                                                                        SHA-256:415025DCE5A086DBFFC4CF322E8EAD55CB45F6D946801F6F5193DF044DB2F004
                                                                                                                                                                                                                                        SHA-512:B97EF7C5203A0105386E4949445350D8FF1C83BDEAEE71CCF8DC22F7F6D4F113CB0A9BE136717895C36EE8455778549F629BF8D8364109185C0BF28F3CB2B2CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.... .h.........." .........@...............................................P......\.....`A.........................................................@...............@..x&..............p............................................................................rdata.._........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-time-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                                        Entropy (8bit):5.253102285412285
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:mt3hwDGWqhWrWEXCVWQ4mWn+deyttuX01k9z3A23x:AWqhWgPSR9zfh
                                                                                                                                                                                                                                        MD5:001E60F6BBF255A60A5EA542E6339706
                                                                                                                                                                                                                                        SHA1:F9172EC37921432D5031758D0C644FE78CDB25FA
                                                                                                                                                                                                                                        SHA-256:82FBA9BC21F77309A649EDC8E6FC1900F37E3FFCB45CD61E65E23840C505B945
                                                                                                                                                                                                                                        SHA-512:B1A6DC5A34968FBDC8147D8403ADF8B800A06771CC9F15613F5CE874C29259A156BAB875AAE4CAAEC2117817CE79682A268AA6E037546AECA664CD4EEA60ADBF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...G............" .........0...............................................@.......&....`A.........................................................0...............0..h&..............p............................................................................rdata..=...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\api-ms-win-crt-utility-l1-1-0.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22136
                                                                                                                                                                                                                                        Entropy (8bit):4.810971823417463
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:p/fHQduDWqhWJWJWadJCsVWQ4mWxrnyttuX01k9z3A2Yv6WT:p/ftWqhWoCsmySR9zfYvvT
                                                                                                                                                                                                                                        MD5:A0776B3A28F7246B4A24FF1B2867BDBF
                                                                                                                                                                                                                                        SHA1:383C9A6AFDA7C1E855E25055AAD00E92F9D6AAFF
                                                                                                                                                                                                                                        SHA-256:2E554D9BF872A64D2CD0F0EB9D5A06DEA78548BC0C7A6F76E0A0C8C069F3C0A9
                                                                                                                                                                                                                                        SHA-512:7C9F0F8E53B363EF5B2E56EEC95E7B78EC50E9308F34974A287784A1C69C9106F49EA2D9CA037F0A7B3C57620FCBB1C7C372F207C68167DF85797AFFC3D7F3BA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......^.....`A............................................^............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\attrs-24.2.0.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\attrs-24.2.0.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:Unicode text, UTF-8 text, with very long lines (411)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11524
                                                                                                                                                                                                                                        Entropy (8bit):5.211520136058075
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ERsUfi6bkQk+k/kKkegToJWicnJsPVA1oz2dv7COmoKTACoEJdQ/0G6lWg+JdQV5:ERsXpLs3VoJWRnJsPvz2dDCHoKsLgA6z
                                                                                                                                                                                                                                        MD5:49CABCB5F8DA14C72C8C3D00ADB3C115
                                                                                                                                                                                                                                        SHA1:F575BECF993ECDF9C6E43190C1CB74D3556CF912
                                                                                                                                                                                                                                        SHA-256:DC9824E25AFD635480A8073038B3CDFE6A56D3073A54E1A6FB21EDD4BB0F207C
                                                                                                                                                                                                                                        SHA-512:923DAEEE0861611D230DF263577B3C382AE26400CA5F1830EE309BD6737EED2AD934010D61CDD4796618BEDB3436CD772D9429A5BED0A106EF7DE60E114E505C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.3.Name: attrs.Version: 24.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\attrs-24.2.0.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3556
                                                                                                                                                                                                                                        Entropy (8bit):5.810477636970161
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:Q9ewrFmJT/oPynEddwBbCobXm9qGmR5VXzskCGD+qLtxO:2ewBoJCKXGeR/XzIiO
                                                                                                                                                                                                                                        MD5:8037E693EAFED6C3D0CCE916BABB50C4
                                                                                                                                                                                                                                        SHA1:2321392AAB7AE3A6A78248E5D5F454124D368EC1
                                                                                                                                                                                                                                        SHA-256:688073F6556808D9139FEA52BEC3802D8C0D7CE07978B98AAE8DB5C98FACC0DF
                                                                                                                                                                                                                                        SHA-512:95B9E6B8F946D2617098C338441AFC5A555FF208947D5731E09EE17B959655161C397F57E14827A95A8FD4554DE8C6E426DC316F858510AE4AA7CA8723C4CF51
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:attr/__init__.py,sha256=l8Ewh5KZE7CCY0i1iDfSCnFiUTIkBVoqsXjX9EZnIVA,2087..attr/__init__.pyi,sha256=aTVHBPX6krCGvbQvOl_UKqEzmi2HFsaIVm2WKmAiqVs,11434..attr/__pycache__/__init__.cpython-311.pyc,,..attr/__pycache__/_cmp.cpython-311.pyc,,..attr/__pycache__/_compat.cpython-311.pyc,,..attr/__pycache__/_config.cpython-311.pyc,,..attr/__pycache__/_funcs.cpython-311.pyc,,..attr/__pycache__/_make.cpython-311.pyc,,..attr/__pycache__/_next_gen.cpython-311.pyc,,..attr/__pycache__/_version_info.cpython-311.pyc,,..attr/__pycache__/converters.cpython-311.pyc,,..attr/__pycache__/exceptions.cpython-311.pyc,,..attr/__pycache__/filters.cpython-311.pyc,,..attr/__pycache__/setters.cpython-311.pyc,,..attr/__pycache__/validators.cpython-311.pyc,,..attr/_cmp.py,sha256=3umHiBtgsEYtvNP_8XrQwTCdFoZIX4DEur76N-2a3X8,4123..attr/_cmp.pyi,sha256=U-_RU_UZOyPUEQzXE6RMYQQcjkZRY25wTH99sN0s7MM,368..attr/_compat.py,sha256=n2Uk3c-ywv0PkFfGlvqR7SzDXp4NOhWmNV_ZK6YfWoM,2958..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\attrs-24.2.0.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):87
                                                                                                                                                                                                                                        Entropy (8bit):4.730668933656452
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeXAaCTQnP+tPCCfA5I:Rt2PcnWBB3
                                                                                                                                                                                                                                        MD5:52ADFA0C417902EE8F0C3D1CA2372AC3
                                                                                                                                                                                                                                        SHA1:B67635615EEF7E869D74F4813B5DC576104825DD
                                                                                                                                                                                                                                        SHA-256:D7215D7625CC9AF60AED0613AAD44DB57EBA589D0CCFC3D8122114A0E514C516
                                                                                                                                                                                                                                        SHA-512:BFA87E7B0E76E544C2108EF40B9FAC8C5FF4327AB8EDE9FEB2891BD5D38FEA117BD9EEBAF62F6C357B4DEADDAD5A5220E0B4A54078C8C2DE34CB1DD5E00F2D62
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: hatchling 1.25.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\attrs-24.2.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1109
                                                                                                                                                                                                                                        Entropy (8bit):5.104415762129373
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                                                        MD5:5E55731824CF9205CFABEAB9A0600887
                                                                                                                                                                                                                                        SHA1:243E9DD038D3D68C67D42C0C4BA80622C2A56246
                                                                                                                                                                                                                                        SHA-256:882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
                                                                                                                                                                                                                                        SHA-512:21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\base_library.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1440734
                                                                                                                                                                                                                                        Entropy (8bit):5.590363711484859
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:mQR5pATG8/R5lUKdcubgAnyfb8hd0iwhJdYf9PyetHHA:mQR5pE/RbVc
                                                                                                                                                                                                                                        MD5:34A1E9C9033D4DBEC9AA8FCE5CF8403F
                                                                                                                                                                                                                                        SHA1:B6379C9E683CF1B304F5027CF42040892799F377
                                                                                                                                                                                                                                        SHA-256:4C21ADBCC2A8D8ADC1D4B693017C6276B03CB505BB810F46709D75AC3FB77668
                                                                                                                                                                                                                                        SHA-512:CEDC5735ECF29A50BADE26040C39B5511E18E6D0A921B05E51EF1C1391B64C43F6D0944DE51E88FAD5A62DB8391C80FBE2D9673FB524F92EA0DBD55E659AC3D6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\certifi\cacert.pem

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):299427
                                                                                                                                                                                                                                        Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                        MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                        SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                        SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                        SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\charset_normalizer\md.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.8208567868970675
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:Y0fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFuCQAAZWQcX6g8H4a81:gFCk2z1/t12iwU5usJFKCyHcqgg
                                                                                                                                                                                                                                        MD5:CBF62E25E6E036D3AB1946DBAFF114C1
                                                                                                                                                                                                                                        SHA1:B35F91EAF4627311B56707EF12E05D6D435A4248
                                                                                                                                                                                                                                        SHA-256:06032E64E1561251EA3035112785F43945B1E959A9BF586C35C9EA1C59585C37
                                                                                                                                                                                                                                        SHA-512:04B694D0AE99D5786FA19F03C5B4DD8124C4F9144CFE7CA250B48A3C0DE0883E06A6319351AE93EA95B55BBBFA69525A91E9407478E40AD62951F1D63D45FF18
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................X......o..............o.......o.......o......j..............n......n......n4.....n......Rich....................PE..d....#.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):121344
                                                                                                                                                                                                                                        Entropy (8bit):5.899699901799497
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:3Ives1m094QtwqlaZTwuQMS/Pf+vGTVmEU:3PsQIJmE
                                                                                                                                                                                                                                        MD5:BAC273806F46CFFB94A84D7B4CED6027
                                                                                                                                                                                                                                        SHA1:773FBC0435196C8123EE89B0A2FC4D44241FF063
                                                                                                                                                                                                                                        SHA-256:1D9ABA3FF1156EA1FBE10B8AA201D4565AE6022DAF2117390D1D8197B80BB70B
                                                                                                                                                                                                                                        SHA-512:EAEC1F072C2C0BC439AC7B4E3AEA6E75C07BD4CD2D653BE8500BBFFE371FBFE045227DAEAD653C162D972CCAADFF18AC7DA4D366D1200618B0291D76E18B125C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yB............................................................................................Rich...........................PE..d....#.g.........." ...).2..........@4.......................................0............`.............................................d...d...................p............ ......@...................................@............P...............................text...x0.......2.................. ..`.rdata...Y...P...Z...6..............@..@.data....=.......0..................@....pdata..p...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography-43.0.3.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography-43.0.3.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5440
                                                                                                                                                                                                                                        Entropy (8bit):5.074230645519915
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
                                                                                                                                                                                                                                        MD5:C891CD93024AF027647E6DE89D0FFCE2
                                                                                                                                                                                                                                        SHA1:01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
                                                                                                                                                                                                                                        SHA-256:EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
                                                                                                                                                                                                                                        SHA-512:3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography-43.0.3.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15485
                                                                                                                                                                                                                                        Entropy (8bit):5.562409393703148
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:1XxTBjWz5jF4ELZVhXau4WPE6FGotqw++NX6in55qw/n+B:1XXjWhCEJaiPE6FGotqw++96in5+B
                                                                                                                                                                                                                                        MD5:13F4AAA0BE473C30F1FCFE7C1E5CC75C
                                                                                                                                                                                                                                        SHA1:D542DDD6490DE41A96F53579F021EE633B32A4AA
                                                                                                                                                                                                                                        SHA-256:5AC071DBE59CB47B67628486C36D8E477CB152A2120147B94197EA5142EC3804
                                                                                                                                                                                                                                        SHA-512:E4E19893A650F91706A472875C398D014AB103D55D065F3D6E9E3AF24AE8D12B87D61C1D1C9C040819E1B9F19A88850780DBA1ED49D380A6273D164169013040
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-311.pyc,,..cryptography/__pycache__/__init__.cpython-311.pyc,,..cryptography/__pycache__/exceptions.cpython-311.pyc,,..cryptography/__p

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography-43.0.3.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):94
                                                                                                                                                                                                                                        Entropy (8bit):5.016084900984752
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
                                                                                                                                                                                                                                        MD5:C869D30012A100ADEB75860F3810C8C9
                                                                                                                                                                                                                                        SHA1:42FD5CFA75566E8A9525E087A2018E8666ED22CB
                                                                                                                                                                                                                                        SHA-256:F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
                                                                                                                                                                                                                                        SHA-512:B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography-43.0.3.dist-info\license_files\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):197
                                                                                                                                                                                                                                        Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                                        MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                                        SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                                        SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                                        SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11360
                                                                                                                                                                                                                                        Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                                        MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                                        SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                                        SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                                        SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1532
                                                                                                                                                                                                                                        Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                                        MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                                        SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                                        SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                                        SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7834624
                                                                                                                                                                                                                                        Entropy (8bit):6.517862303223651
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
                                                                                                                                                                                                                                        MD5:BFD28B03A4C32A9BCB001451FD002F67
                                                                                                                                                                                                                                        SHA1:DD528FD5F4775E16B2E743D3188B66F1174807B2
                                                                                                                                                                                                                                        SHA-256:8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
                                                                                                                                                                                                                                        SHA-512:6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\frozenlist\_frozenlist.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):87040
                                                                                                                                                                                                                                        Entropy (8bit):5.923038424678
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:qundZwmaApD60dSpyT4DIk54S85QwvpC/vNZAg:nLwUpzAczh+wvpqvNZP
                                                                                                                                                                                                                                        MD5:E8CADECD9A3684DBA357FC0489C62492
                                                                                                                                                                                                                                        SHA1:4C488D097A85F9BC61F842E3DCF42E228B9885B3
                                                                                                                                                                                                                                        SHA-256:02053F53EB078BE1488735878DC68524F0E103342250A09EECAE3533D8E9C770
                                                                                                                                                                                                                                        SHA-512:2443C90931A9AD672938D13C60FDB564EE8AA9FCA85E0426445CE36C395AC9675B6F6488518FF16071731CF8E9A0C2F8DD3182120FD9A7DAF6FD2EE813D2C781
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.5...f...f...f.dDf...f...g...f.d.g...f...g...f...g...f...g...f..g...f...f2..f..g...f..g...f.(f...f..g...fRich...f................PE..d......g.........." ...).....v............................................................`.........................................`7..h....7..x............p..X....................&..............................`%..@...............@............................text............................... ..`.rdata...J.......L..................@..@.data........P.......6..............@....pdata..X....p.......D..............@..@.rsrc................P..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\libcrypto-3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5162776
                                                                                                                                                                                                                                        Entropy (8bit):5.958207976652471
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
                                                                                                                                                                                                                                        MD5:51E8A5281C2092E45D8C97FBDBF39560
                                                                                                                                                                                                                                        SHA1:C499C810ED83AAADCE3B267807E593EC6B121211
                                                                                                                                                                                                                                        SHA-256:2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
                                                                                                                                                                                                                                        SHA-512:98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\libffi-8.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):39696
                                                                                                                                                                                                                                        Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                        MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                        SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                        SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                        SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\libssl-3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):790296
                                                                                                                                                                                                                                        Entropy (8bit):5.607732992846443
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
                                                                                                                                                                                                                                        MD5:BFC834BB2310DDF01BE9AD9CFF7C2A41
                                                                                                                                                                                                                                        SHA1:FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
                                                                                                                                                                                                                                        SHA-256:41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
                                                                                                                                                                                                                                        SHA-512:6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\lz4-4.3.3.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\lz4-4.3.3.dist-info\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1523
                                                                                                                                                                                                                                        Entropy (8bit):5.162397061365918
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:oY3UnzobbOmFTVJcFTzA6GLQrBTP49H432sZEOkHs8nRO632smyxtTfr10VZlQfS:ROmJIJzSEP6H432smp32smEtP10VwHy
                                                                                                                                                                                                                                        MD5:2F7382E069BEAC97D607124540FD5661
                                                                                                                                                                                                                                        SHA1:1684541BA4AF5542BA7E6490C25882CA125A1C47
                                                                                                                                                                                                                                        SHA-256:A7D65D1DD4DCC86DCA5D17D46AA4A1C77669C9B72F55F298E9E2212F2905C0CF
                                                                                                                                                                                                                                        SHA-512:4BD08A47B9B67098E38895E96136B3A5EE4711DEF8EB6AC87B522F2A024FC7F22EA4B53E048C2BB3F636EA81CD0814B53B4E20361EBC1A8CDE1C8E57F7A76089
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright (c) 2012-2013, Steeve Morin..All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions are met:....1. Redistributions of source code must retain the above copyright notice,.. this list of conditions and the following disclaimer.....2. Redistributions in binary form must reproduce the above copyright notice,.. this list of conditions and the following disclaimer in the documentation.. and/or other materials provided with the distribution.....3. Neither the name of Steeve Morin nor the names of its contributors may be.. used to endorse or promote products derived from this software without.. specific prior written permission.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"..AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE..IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE..ARE DISCLAIMED.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\lz4-4.3.3.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3758
                                                                                                                                                                                                                                        Entropy (8bit):5.092767270997029
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:DdPHo8lGovhSaWMqCBAInB8fhfxF914CAXTzbIYB/HF4s1LWlAjC:tHoczVBAu6fhft15AzjlLLC
                                                                                                                                                                                                                                        MD5:3D855AD86A99255B3248D88C524148FC
                                                                                                                                                                                                                                        SHA1:1ADBA31F74CC4BA33AD9AE31EE29CABA66EB4D93
                                                                                                                                                                                                                                        SHA-256:612E3D4394DFDCA3E93C74FF02ABC012757279F7BA879D875BEE58F643A45FFE
                                                                                                                                                                                                                                        SHA-512:99E0C5E2DD734CBB653FDFC80C8F568EEEFAAAEF83BA92431DCE97770077759A0550FA6FC58EC3F86C67774CA9F02C0EC33164B4471DB2D659202979C868A4EF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.1..Name: lz4..Version: 4.3.3..Summary: LZ4 Bindings for Python..Home-page: https://github.com/python-lz4/python-lz4..Author: Jonathan Underwood..Author-email: jonathan.underwood@gmail.com..Classifier: Development Status :: 5 - Production/Stable..Classifier: License :: OSI Approved :: BSD License..Classifier: Intended Audience :: Developers..Classifier: Programming Language :: C..Classifier: Programming Language :: Python..Classifier: Programming Language :: Python :: 3.8..Classifier: Programming Language :: Python :: 3.9..Classifier: Programming Language :: Python :: 3.10..Classifier: Programming Language :: Python :: 3.11..Classifier: Programming Language :: Python :: 3.12..Requires-Python: >=3.8..License-File: LICENSE..Provides-Extra: docs..Requires-Dist: sphinx >=1.6.0 ; extra == 'docs'..Requires-Dist: sphinx-bootstrap-theme ; extra == 'docs'..Provides-Extra: flake8..Requires-Dist: flake8 ; extra == 'flake8'..Provides-Extra: tests..Requires-Dist: pytest !=3.3.0 ;

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\lz4-4.3.3.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1224
                                                                                                                                                                                                                                        Entropy (8bit):5.865132521742272
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:on/2zDBvNGAt5OjUyWolSl1xp++ihiB5YJ+SdX54nhOZH58lFc:onuXBZqjUhocllkiHYA+54nYZH5iFc
                                                                                                                                                                                                                                        MD5:5767B79313C4C7634B59A06B711F4A2F
                                                                                                                                                                                                                                        SHA1:906B83790268C9042874E5E05DC7C0CF57106E1C
                                                                                                                                                                                                                                        SHA-256:BB6AB4126ED02B0B83CC89FCF371C9D5F4BC927DE87632245007569ED49F6D3D
                                                                                                                                                                                                                                        SHA-512:8B93C1D32CD84AAC9B0E5358B84A498C524FD45E365CE088AA3A8A0D8D1B4916B053A1628BAE63111C13AFFFD367CF5AFA3437106F83968B11F34E9A1E5D8BB6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:lz4-4.3.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..lz4-4.3.3.dist-info/LICENSE,sha256=p9ZdHdTcyG3KXRfUaqShx3ZpybcvVfKY6eIhLykFwM8,1523..lz4-4.3.3.dist-info/METADATA,sha256=YS49Q5Tf3KPpPHT_AqvAEnVyefe6h52HW-5Y9kOkX_4,3758..lz4-4.3.3.dist-info/RECORD,,..lz4-4.3.3.dist-info/WHEEL,sha256=ircjsfhzblqgSzO8ow7-0pXK-RVqDqNRGQ8F650AUNM,102..lz4-4.3.3.dist-info/top_level.txt,sha256=cX6_gxFUdNSo40TfxrGpTCgu7epGm3yW3m2k7irTDzI,4..lz4/__init__.py,sha256=e_8j-K4TJx38qcPNjoZP_pNDo8IpE4D2ZWl4p50iV_8,646..lz4/__pycache__/__init__.cpython-311.pyc,,..lz4/__pycache__/version.cpython-311.pyc,,..lz4/_version.cp311-win_amd64.pyd,sha256=BXu927P5cO4vjggWtfvZIvPt6wgmoQUK9Cd_j9ngmks,11264..lz4/block/__init__.py,sha256=DSUbS7zMlKKeLs8JO9riOBO5Q_lVoSB-nwgjfhBeXt0,71..lz4/block/__pycache__/__init__.cpython-311.pyc,,..lz4/block/_block.cp311-win_amd64.pyd,sha256=N8neJ86OtjJrV98ODkd4GPyX1va57JBvAp6OU41xM9c,76800..lz4/frame/__init__.py,sha256=ZnJ4sJ1HStPpmJpo0q_CGm9fDEui3Tt3V8DmMi68SZM,

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\lz4-4.3.3.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):102
                                                                                                                                                                                                                                        Entropy (8bit):5.0254896858991245
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeX7MWcSlVlbY3KgP+tkKcfxLQLn:RtBMwlVCxWK5NQLn
                                                                                                                                                                                                                                        MD5:4F7020292A2B5B7F3BCC9B1F5B5AFEB4
                                                                                                                                                                                                                                        SHA1:D2C2D48CCB76629F7604B9881357F129D76F635F
                                                                                                                                                                                                                                        SHA-256:8AB723B1F8736E5AA04B33BCA30EFED295CAF9156A0EA351190F05EB9D0050D3
                                                                                                                                                                                                                                        SHA-512:4D7598EEC10105C1826732DC78FC89850A7343B733A5441DDB53606F8BA7A15C8F058C6C9C0C0EE99951B383BB30C94279FDCE7F0E588A70367DC46D3C672E20
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp311-cp311-win_amd64..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\lz4-4.3.3.dist-info\top_level.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):2.0
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:fn:f
                                                                                                                                                                                                                                        MD5:194B36A8466E4650490040D599B09C0E
                                                                                                                                                                                                                                        SHA1:4CB4A2C46E9892B8A712716F9B42537D1962BBB4
                                                                                                                                                                                                                                        SHA-256:717EBF83115474D4A8E344DFC6B1A94C282EEDEA469B7C96DE6DA4EE2AD30F32
                                                                                                                                                                                                                                        SHA-512:C55B2D3D46EC558533B4019DFFA87B1F93E7866DBCDE8D00243D8C54F1A3094933256BD25EAA0333D6EC4B308F1A4C92630BBEF6E10BE7892774DCCF5556FE77
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:lz4.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\lz4\_version.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11264
                                                                                                                                                                                                                                        Entropy (8bit):4.696226726378701
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:VkW+7TRSsA2zVJoYeEw0VTmrgJyUCN5XsMtEZqfH/OZYUo8/NcX6gZYPV:KHRSsvZJ5YNRZEZqn0YUHNcqg4
                                                                                                                                                                                                                                        MD5:44229B69D9EE7308DA5D880081A1CB75
                                                                                                                                                                                                                                        SHA1:AEF85718A2658629A7FB399E3D4AED0001409182
                                                                                                                                                                                                                                        SHA-256:057BBDDBB3F970EE2F8E0816B5FBD922F3EDEB0826A1050AF4277F8FD9E09A4B
                                                                                                                                                                                                                                        SHA-512:0622A64DA707BCF8EE5E2EA48EFACC3EBB70A4DB16F50DD26DD407AAFC178D0AB443651F38B67B1423C4024E5C1D339509049FB0D2C759659AB980B92D8F9F66
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y7..8Y..8Y..8Y..@...8Y..GX..8Y.@X..8Y..G\..8Y..G]..8Y..GZ..8Y.7EX..8Y..8X..8Y..Q..8Y..Y..8Y.....8Y..[..8Y.Rich.8Y.........................PE..d....@.e.........." ...%.....................................................p............`.........................................p*..`....*..d....P.......@...............`..D...p%..............................0$..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..D....`.......*..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\lz4\block\_block.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):76800
                                                                                                                                                                                                                                        Entropy (8bit):6.201674022552313
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:+V4xVkjuE0OoP2gFMg/Bc/0amC8p7g4PvjmfO3+oO3h7Xxtu:Pxyjp4Pnfc/ypEaL+O3+oo9Xxtu
                                                                                                                                                                                                                                        MD5:910C0ED11E93D4EF003ED0065A31164A
                                                                                                                                                                                                                                        SHA1:CE3D5B6B289F77F95AF3B60B436FBD9CE821AF2F
                                                                                                                                                                                                                                        SHA-256:37C9DE27CE8EB6326B57DF0E0E477818FC97D6F6B9EC906F029E8E538D7133D7
                                                                                                                                                                                                                                        SHA-512:6D9A9C17B22815B3453E4CA42BC1579448B175F55CC52ECE876F20699BC5DA193E075E86A9B063745797F39D988C457ED56B997DF023EAE9F68BD31E7543F2FE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r?Xk6^686^686^68?&.80^68#!794^68}&794^68#!39:^68#!29>^68#!592^68.#795^686^78.^68..>95^68..697^68...87^68..497^68Rich6^68................PE..d....@.e.........." ...%.....8............................................................`..........................................-..\....-.......`.......P..P............p..d....$..............................@#..@............................................text...(........................... ..`.rdata...$.......&..................@..@.data...p....@....... ..............@....pdata..P....P......."..............@..@.rsrc........`.......(..............@..@.reloc..d....p.......*..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\multidict\_multidict.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):47616
                                                                                                                                                                                                                                        Entropy (8bit):5.315276044408234
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:j2vE6F6hmSrnDe651sYEYMXB/6BvE6n0/d3g:jAoVDeWlE5/6BvDni
                                                                                                                                                                                                                                        MD5:ECC0B2FCDA0485900F4B72B378FE4303
                                                                                                                                                                                                                                        SHA1:40D9571B8927C44AF39F9D2AF8821F073520E65A
                                                                                                                                                                                                                                        SHA-256:BCBB43CE216E38361CB108E99BAB86AE2C0F8930C86D12CADFCA703E26003CB1
                                                                                                                                                                                                                                        SHA-512:24FD07EB0149CB8587200C055F20FF8C260B8E626693C180CBA4E066194BED7E8721DDE758B583C93F7CB3D691B50DE6179BA86821414315C17B3D084D290E70
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..T:l..:l..:l..3.?.8l..*..8l..q...8l..*..9l..*..2l..*..6l..U..9l..:l..Ll..r..;l..r..;l..r.S.;l..r..;l..Rich:l..........................PE..d...;}.f.........." ...).\...`......`^....................................................`.............................................d.......d...............................L.......................................@............p...............................text....Z.......\.................. ..`.rdata...,...p.......`..............@..@.data....#..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\propcache\_helpers_c.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):74752
                                                                                                                                                                                                                                        Entropy (8bit):5.864853826664042
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:kvue4NaxmMtgkBiNWXT+z6eNO/oNJ67bScEq:kvuezmMtgSyWD4NsnbScE
                                                                                                                                                                                                                                        MD5:04444380B89FB22B57E6A72B3AE42048
                                                                                                                                                                                                                                        SHA1:CFE9C662CB5CA1704E3F0763D02E0D59C5817D77
                                                                                                                                                                                                                                        SHA-256:D123D7FEFDE551C82EB61454D763177322E5CE1EAA65DC489E19DE5AB7FAF7B4
                                                                                                                                                                                                                                        SHA-512:9E7D367BAB0F6CC880C5870FDCDB06D9A9E5EB24EBA489CA85549947879B0FA3C586779FFCEA0FCA4C50AA67DAD098E7BD9E82C00E2D00412D9441991267D2DA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..T.l...l...l....?..l......l..Q....l......l......l......l..u...l...l...l..R...l..R...l..R.S..l..R...l..Rich.l..................PE..d......g.........." ...).....l......P........................................p............`.........................................`...d.......d....P.......@..H............`..T.......................................@............................................text............................... ..`.rdata...E.......F..................@..@.data........ ......................@....pdata..H....@......................@..@.rsrc........P....... ..............@..@.reloc..T....`......."..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):67072
                                                                                                                                                                                                                                        Entropy (8bit):5.909510426434191
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:aJsHmR02IvVxv7WCyKm7c5Th4MBHTOvyyaZE:apIvryCyKx5Th4M5OvyyO
                                                                                                                                                                                                                                        MD5:3E579844160DE8322D574501A0F91516
                                                                                                                                                                                                                                        SHA1:C8DE193854F7FC94F103BD4AC726246981264508
                                                                                                                                                                                                                                        SHA-256:95F01CE7E37F6B4B281DBC76E9B88F28A03CB02D41383CC986803275A1CD6333
                                                                                                                                                                                                                                        SHA-512:EE2A026E8E70351D395329C78A07ACB1B9440261D2557F639E817A8149BA625173EF196AED3D1C986577D78DC1A7EC9FED759C19346C51511474FE6D235B1817
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d.....qf.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\pyexpat.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):199448
                                                                                                                                                                                                                                        Entropy (8bit):6.37860626187966
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:JmRBHO1UpyGKEjQxmMLIQjmuMgk6k6k6k6k6k6jHlDX:JmRBHJS7Mgk6k6k6k6k6k6jFDX
                                                                                                                                                                                                                                        MD5:6527063F18E8D49D04E2CC216C2F0B27
                                                                                                                                                                                                                                        SHA1:917C349C62689F9B782A314CE4B2311B6B826606
                                                                                                                                                                                                                                        SHA-256:5604F629523125904909547A97F3CDB5DBFE33B39878BAD77534DE0C3C034387
                                                                                                                                                                                                                                        SHA-512:67C87D11683A0F4E1BC4083FF05EDEE423155F829051C3FA66CC4F2CFB98CF7374B3A06EB37095E19F5F2A6C8DA83F0C0E3F7EB964694992B525F81B1B00F423
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d......e.........." ...#..................................................... ......X.....`.............................................P................................/..........`3..T........................... 2..@............ ...............................text...3........................... ..`.rdata....... ......................@..@.data...@!..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\python3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):67352
                                                                                                                                                                                                                                        Entropy (8bit):6.1462717896521335
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:lGw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJa:r/5k8cnzeJd9IVL0v7SyJwx/
                                                                                                                                                                                                                                        MD5:D8BA00C1D9FCC7C0ABBFFB5C214DA647
                                                                                                                                                                                                                                        SHA1:5FA9D5700B42A83BFCC125D1C45E0111B9D62035
                                                                                                                                                                                                                                        SHA-256:E45452EFA356DB874F2E5FF08C9CC0FE22528609E5D341F8FB67BA48885AB77D
                                                                                                                                                                                                                                        SHA-512:DF1B714494856F618A742791EEFBF470B2EEE07B51D983256E4386EA7D48DA5C7B1E896F222EA55A748C9413203886CDE3A65EF9E7EA069014FA626F81D79CD3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d......e.........." ...#.................................................................`.........................................`...P................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\python311.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5763864
                                                                                                                                                                                                                                        Entropy (8bit):6.089317968812699
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:CdT9zf0+IXY3qd4biqm46oWHrMGYPtA81:CdT9zflIXgq/epGWAs
                                                                                                                                                                                                                                        MD5:65E381A0B1BC05F71C139B0C7A5B8EB2
                                                                                                                                                                                                                                        SHA1:7C4A3ADF21EBCEE5405288FC81FC4BE75019D472
                                                                                                                                                                                                                                        SHA-256:53A969094231B9032ABE4148939CE08A3A4E4B30B0459FC7D90C89F65E8DCD4A
                                                                                                                                                                                                                                        SHA-512:4DB465EF927DFB019AB6FAEC3A3538B0C3A8693EA3C2148FD16163BF31C03C899DFDF350C31457EDF64E671E3CC3E46851F32F0F84B267535BEBC4768EF53D39
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ..qN.qN.qN.$.O.qN.$...qN.$.K.qN.$.J.qN.$.M.qN....qN...O.qN.qO..pN.B.C.]qN.B.N.qN.B...qN.B.L.qN.Rich.qN.........PE..d......e.........." ...#.R%..>7......=........................................\.....T.X...`...........................................@......[A......p[.......V../....W../....[.lC....).T...........................p.).@............p%..............................text...ZQ%......R%................. ..`.rdata.......p%......V%.............@..@.data....#....A..T...fA.............@....pdata.../....V..0....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......vV.............@..@.reloc..lC....[..D....V.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\pywin32_system32\pythoncom311.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):670208
                                                                                                                                                                                                                                        Entropy (8bit):6.035999626973864
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:ngSkceIv3zBJBQoXNi4LCQqAOffa1tpd5g:gSkc/v3zB9NiEWfa
                                                                                                                                                                                                                                        MD5:31C1BF2ACA5DF417F6CE2618C3EEFE7E
                                                                                                                                                                                                                                        SHA1:4C2F7FE265FF28396D03BA0CAB022BBD1785DBF2
                                                                                                                                                                                                                                        SHA-256:1DAF7C87B48554F1481BA4431102D0429704832E42E3563501B1FFDD3362FCD1
                                                                                                                                                                                                                                        SHA-512:5723145F718CC659ADD658BA545C5D810E7032842907BAB5C2335E3DE7F20FE69B58AA42512FD67EA8C6AA133E59E0C26BD90700BDD0D0171AF6C1E1C73A2719
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..~f..-f..-f..-o..-l..-4..,b..-4..,q..-4..,n..-4..,b..-...,d..--..,k..-...,d..--..,o..-f..-5..-...,7..-...,g..-...,g..-Richf..-................PE..d...&..g.........." ......................................................................`..........................................U...c..(...........l....@...z............... ..P...T...............................8............................................text............................... ..`.rdata..x$.......&..................@..@.data....I..........................@....pdata...z...@...|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\pywin32_system32\pywintypes311.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):134656
                                                                                                                                                                                                                                        Entropy (8bit):5.999117329459055
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:kLcVKY3tOSjPenBttgY/r06Yr27vJmxETaTX7wevxJ:kLcVKY3tOWPxY/rkqzJmxEmTXMev
                                                                                                                                                                                                                                        MD5:5D67ABF69A8939D13BEFB7DE9889B253
                                                                                                                                                                                                                                        SHA1:BCBBF88C05732D4E1E3811FD312425C1C92018D1
                                                                                                                                                                                                                                        SHA-256:615EB8A75F9ED9371A59DA8F31E27EE091C013DB0B9164A5124CA0656EA47CB4
                                                                                                                                                                                                                                        SHA-512:FA34EB05996C41F23524A8B4F1FAED0BDD41224D8E514AA57D568A55D2044C32798C1357F22C72AD79FD02948CAAD89B98B8E9B0AD2927E4A0169739335271CE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I+.j'x.j'x.j'x...x.j'x..&y.j'x...x.j'x.."y.j'x..#y.j'x..$y.j'x..#y.j'x..&y.j'x..&y.j'x.j&xCj'xk..y.j'xk.'y.j'xk.%y.j'xRich.j'x................PE..d......g.........." ................,........................................P............`..........................................u..lB......,....0..l.......L............@..0....Q..T............................R..8............................................text...y........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\select.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):30488
                                                                                                                                                                                                                                        Entropy (8bit):6.582368880935187
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:neUeJhHq2GD9IVQGA5YiSyv3g+AMxkEdC:neUeJhK2GD9IVQGS7SyfgMxRC
                                                                                                                                                                                                                                        MD5:8472D39B9EE6051C961021D664C7447E
                                                                                                                                                                                                                                        SHA1:B284E3566889359576D43E2E0E99D4ACF068E4FB
                                                                                                                                                                                                                                        SHA-256:8A9A103BC417DEDE9F6946D9033487C410937E1761D93C358C1600B82F0A711F
                                                                                                                                                                                                                                        SHA-512:309F1EC491D9C39F4B319E7CE1ABDEDF11924301E4582D122E261E948705FB71A453FEC34F63DF9F9ABE7F8CC2063A56CD2C2935418AB54BE5596AADC2E90AD3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q|'.q|'.q|'...'.q|'q.}&.q|'q.y&.q|'q.x&.q|'q..&.q|'..}&.q|'.q}'.q|'..}&.q|'..q&.q|'..|&.q|'...'.q|'..~&.q|'Rich.q|'........PE..d......e.........." ...#.....2......................................................;.....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\setuptools-65.5.0.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\setuptools-65.5.0.dist-info\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1050
                                                                                                                                                                                                                                        Entropy (8bit):5.072538194763298
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                                                        MD5:7A7126E068206290F3FE9F8D6C713EA6
                                                                                                                                                                                                                                        SHA1:8E6689D37F82D5617B7F7F7232C94024D41066D1
                                                                                                                                                                                                                                        SHA-256:DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
                                                                                                                                                                                                                                        SHA-512:C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\setuptools-65.5.0.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6301
                                                                                                                                                                                                                                        Entropy (8bit):5.107162422517841
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:W4rkAIG0wRg8wbNDdq6T9927uoU/GBpHFwTZ:Sq0wRg8wbNDdBh927uoU/GBRFi
                                                                                                                                                                                                                                        MD5:9E59BD13BB75B38EB7962BF64AC30D6F
                                                                                                                                                                                                                                        SHA1:70F6A68B42695D1BFA55ACB63D8D3351352B2AAC
                                                                                                                                                                                                                                        SHA-256:80C7A3B78EA0DFF1F57855EE795E7D33842A0827AA1EF4EE17EC97172A80C892
                                                                                                                                                                                                                                        SHA-512:67AC61739692ECC249EBDC8F5E1089F68874DCD65365DB1C389FDD0CECE381591A30B99A2774B8CAAA00E104F3E35FF3745AFF6F5F0781289368398008537AE7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.1.Name: setuptools.Version: 65.5.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.Project-URL: Documentation, https://setuptools.pypa.io/.Project-URL: Changelog, https://setuptools.pypa.io/en/stable/history.html.Keywords: CPAN PyPI distutils eggs package management.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.7.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requi

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\setuptools-65.5.0.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):37694
                                                                                                                                                                                                                                        Entropy (8bit):5.555787611309118
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:vSzcBlShgRUhbul9nXJkpIVh498WjXYH0+5+E/8mrnaDoaQP7IOQRJqxBPgof2yd:vc853yQXYAY8AKCT9r2/GsIVxE9Im
                                                                                                                                                                                                                                        MD5:087F72A04BB085627494651E36C4C513
                                                                                                                                                                                                                                        SHA1:1E39070E246F91D8926268A033C6F584E629E2DE
                                                                                                                                                                                                                                        SHA-256:BFB77A968E06417BD37023BF1A2D7F1AAE9D8E74231665D6699D5BB82BDBD7B0
                                                                                                                                                                                                                                        SHA-512:39CE042A20324C6B63A192D70E56B36318C45D04B810A6BD333D1D40B6DAAD947AFB9156C003BC86C700A59F0F25753416D754DA06C808814920F92582CB6058
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:_distutils_hack/__init__.py,sha256=TSekhUW1fdE3rjU3b88ybSBkJxCEpIeWBob4cEuU3ko,6128.._distutils_hack/__pycache__/__init__.cpython-311.pyc,,.._distutils_hack/__pycache__/override.cpython-311.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=JjjOniUA5XKl4N5_rtZmHrVp0baW_LoHsN0iPaX10iQ,151..pkg_resources/__init__.py,sha256=fT5Y3P1tcSX8sJomClUU10WHeFmvqyNZM4UZHzdpAvg,108568..pkg_resources/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/zipp.cpython-311.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/importlib_resources/__init__.py,sha256=evPm12kLgYqTm-pbzm60bOuumumT8IpBNWFp0uMyrzE,506..pkg_resources/_vendor/importli

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\setuptools-65.5.0.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):92
                                                                                                                                                                                                                                        Entropy (8bit):4.820827594031884
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeX7MWcSlViZHKRRP+tPCCfA5S:RtBMwlViojWBBf
                                                                                                                                                                                                                                        MD5:4D57030133E279CEB6A8236264823DFD
                                                                                                                                                                                                                                        SHA1:0FDC3988857C560E55D6C36DCC56EE21A51C196D
                                                                                                                                                                                                                                        SHA-256:1B5E87E00DC87A84269CEAD8578B9E6462928E18A95F1F3373C9EEF451A5BCC0
                                                                                                                                                                                                                                        SHA-512:CD98F2A416AC1B13BA82AF073D0819C0EA7C095079143CAB83037D48E9A5450D410DC5CF6B6CFF3F719544EDF1C5F0C7E32E87B746F1C04FE56FAFD614B39826
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\setuptools-65.5.0.dist-info\entry_points.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2740
                                                                                                                                                                                                                                        Entropy (8bit):4.540737240939103
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:lELcZDy3g6ySDsm90rZh2Phv4hhpTqTog:yLAP8arZoP94hTTqcg
                                                                                                                                                                                                                                        MD5:D3262B65DB35BFFAAC248075345A266C
                                                                                                                                                                                                                                        SHA1:93AD6FE5A696252B9DEF334D182432CDA2237D1D
                                                                                                                                                                                                                                        SHA-256:DEC880BB89189B5C9B1491C9EE8A2AA57E53016EF41A2B69F5D71D1C2FBB0453
                                                                                                                                                                                                                                        SHA-512:1726750B22A645F5537C20ADDF23E3D3BAD851CD4BDBA0F9666F9F6B0DC848F9919D7AF8AD8847BD4F18D0F8585DDE51AFBAE6A4CAD75008C3210D17241E0291
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build = setuptools.command.build:build.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.editable_wheel = setuptools.command.editable_wheel:editable_wheel.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.seto

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\setuptools-65.5.0.dist-info\top_level.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):41
                                                                                                                                                                                                                                        Entropy (8bit):3.9115956018096876
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:3Wd+Nt8AfQYv:3Wd+Nttv
                                                                                                                                                                                                                                        MD5:789A691C859DEA4BB010D18728BAD148
                                                                                                                                                                                                                                        SHA1:AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
                                                                                                                                                                                                                                        SHA-256:77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
                                                                                                                                                                                                                                        SHA-512:BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:_distutils_hack.pkg_resources.setuptools.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\sqlite3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1504024
                                                                                                                                                                                                                                        Entropy (8bit):6.578984314535122
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:M5WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lYfore60b:Mb0yVKMyjWR6nofQm7U59HWKYYD
                                                                                                                                                                                                                                        MD5:256224CC25D085663D4954BE6CC8C5B5
                                                                                                                                                                                                                                        SHA1:9931CC156642E2259DFABF0154FDDF50D86E9334
                                                                                                                                                                                                                                        SHA-256:5AC6EE18CDCA84C078B66055F5E9FFC6F8502E22EAF0FA54AEEC92B75A3C463E
                                                                                                                                                                                                                                        SHA-512:A28ABF03199F0CE9F044329F7EBA2F1D8ECBC43674337AAFBF173F567158BA9046036DA91DC3E12C2BB1D7842953526EDBA14BC03F81ECE63DCEDCC9413213A7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#..................................................................`.........................................Px...".............................../...........*..T............................(..@...............8............................text............................... ..`.rdata..............................@..@.data...PG.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\ucrtbase.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1016584
                                                                                                                                                                                                                                        Entropy (8bit):6.669319438805479
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
                                                                                                                                                                                                                                        MD5:0E0BAC3D1DCC1833EAE4E3E4CF83C4EF
                                                                                                                                                                                                                                        SHA1:4189F4459C54E69C6D3155A82524BDA7549A75A6
                                                                                                                                                                                                                                        SHA-256:8A91052EF261B5FBF3223AE9CE789AF73DFE1E9B0BA5BDBC4D564870A24F2BAE
                                                                                                                                                                                                                                        SHA-512:A45946E3971816F66DD7EA3788AACC384A9E95011500B458212DC104741315B85659E0D56A41570731D338BDF182141C093D3CED222C007038583CEB808E26FD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`............................................................`A................................................p......................F...=......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\unicodedata.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1141016
                                                                                                                                                                                                                                        Entropy (8bit):5.435201566416684
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:C3kYbfjwR6nbVonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1Ji:CUYbM40IDJcjEwPgPOG6Xyd461Ji
                                                                                                                                                                                                                                        MD5:57F8F40CF955561A5044DDFFA4F2E144
                                                                                                                                                                                                                                        SHA1:19218025BCAE076529E49DDE8C74F12E1B779279
                                                                                                                                                                                                                                        SHA-256:1A965C1904DA88989468852FDC749B520CCE46617B9190163C8DF19345B59560
                                                                                                                                                                                                                                        SHA-512:DB2A7A32E0B5BF0684A8C4D57A1D7DF411D8EB1BC3828F44C95235DD3AF40E50A198427350161DFF2E79C07A82EF98E1536E0E013030A15BDF1116154F1D8338
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4m..4m..4m..=...2m......6m......9m......<m......7m......7m......6m..4m..em......5m......5m....j.5m......5m..Rich4m..................PE..d......e.........." ...#.@..........P*...............................................~....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\win32\_win32sysloader.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.113812591033072
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:rCm72PEO1jIUs0YqEcPbF55UgCWV4rofnDPdRD0hvHvcqvn7ycIt/G/:rardA0Bzx14r6nDrOhv+O/
                                                                                                                                                                                                                                        MD5:B58CA169FDCFFAB726391D3906DD9A4E
                                                                                                                                                                                                                                        SHA1:C4BB8DA84A5D9C31D0ACB7A4127F55E696F414DF
                                                                                                                                                                                                                                        SHA-256:1A8DCDBD730166889C03FAF285DC1DD9F16090DFE81043D80A9D6308300EBAC9
                                                                                                                                                                                                                                        SHA-512:AA23DEBF80D89A40677D1BF1C7C6C3445A79E76419865B86D0D6A605656478067EBEA2752348FCF77D583D2E5DCD284DA7F55F751D6441E647565DA77F982966
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Dg..%..%..%..]..%...P..%...]..%...P..%...P..%...P..%.....%..%..%..LP..%..LP..%..LP..%..Rich.%..................PE..d......g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\win32\win32api.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):133120
                                                                                                                                                                                                                                        Entropy (8bit):5.849201651779307
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:znvpE3JJ/Q7DspOCQUUU40Oc3lRVFhLaNzvBii7qQvmwCoY9LQPe:T4xG4pOCQUUU4rWlRVgv5qQSoY9
                                                                                                                                                                                                                                        MD5:D02300D803850C3B0681E16130FECEE4
                                                                                                                                                                                                                                        SHA1:6411815E2A908432A640719ECFE003B43BBBA35C
                                                                                                                                                                                                                                        SHA-256:B938C8CD68B15EC62F053045A764D8DD38162A75373B305B4CF1392AC05DF5F9
                                                                                                                                                                                                                                        SHA-512:6FAD1836614869AB3BB624BDA9943CEAF9E197B17CA4F4FFE78699492B72F95EEE02AE1BB07C0508438956BEF10CC1E656DDF75D0EDC9EF71A3860AF39075564
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..Vx...x...x...q...p...*..|...*..p...*..|......z.......z...*..o...3..s...x...-......z......y......y...Richx...........PE..d......g.........." .........................................................P............`.........................................P...............0..\....................@..X....v..T............................;..8............0.........@....................text............................... ..`.rdata..b....0......................@..@.data...X(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\win32\win32trace.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):23552
                                                                                                                                                                                                                                        Entropy (8bit):5.281874510289411
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:9eeH8ZmV+zknwMswDuVQO0T8DmMel2/QEVR7AWCq5yn9ukF1B3:N+zi/uVQ1Q/QEVR1NUpB
                                                                                                                                                                                                                                        MD5:965E9833F4CD7A45C2C1EE85EFC2DA3B
                                                                                                                                                                                                                                        SHA1:3C6888194AD30E17DC5EEA7418133A541BCDDF07
                                                                                                                                                                                                                                        SHA-256:5ECD0274DC220312824BB3086B3E129E38A9DCB06913A2F6173A94DC256BF4C5
                                                                                                                                                                                                                                        SHA-512:F8C4E0C82A8229B3BDB897B536EE73B5D2A9A2810B73DCC77C880961A9A16E43746234A108A9A15BF18638FCFB3086E0F5EEFD85D5BF6F799718DC6F199C4A26
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(U.wF..wF..wF......wF...G..wF...C..wF...B..wF...E..wF.D.G..wF...G..wF...G..wF..wG..wF.D.O..wF.D.F..wF.D.D..wF.Rich.wF.................PE..d......g.........." .....,...,.......(....................................................`......................................... Q..T...tQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\win32com\shell\shell.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):535040
                                                                                                                                                                                                                                        Entropy (8bit):6.1723495244729625
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:SBetHVSFgAXb3MWUF6w7FK3oHPl8eqTOU:SQkgAL3Md983C8eq
                                                                                                                                                                                                                                        MD5:43AA404015B0CEE369E941DC30B3F4B0
                                                                                                                                                                                                                                        SHA1:A34CBA0D08A17934D84B16FCFF5282367EAA08AA
                                                                                                                                                                                                                                        SHA-256:3FB83E9A14901321324F17D11DA50802B6777733E1EE0FD4F89DB0FD09C61690
                                                                                                                                                                                                                                        SHA-512:A8548F39F371B2389EEA45DA4248FFC015F5B243E957BD12B88661DB91D4D745A1CD1E772BDD6C739A87E69A88947FB58248BB394E1C5D21C0A9324EFC87724B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#t.wM'.wM'.wM'...'.wM'..L&.wM'..H&.wM'..I&.wM'..N&.wM'..I&.wM'..L&.wM'!.L&.wM'..K&.wM'..L&.wM'.wL'.wM'!.D&.wM'!.M&.wM'!.O&.wM'Rich.wM'........PE..d...}..g.........." .....2................................................................`.............................................L...<...........L....0..${..............h!......T...............................8............P..(............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data........P...`...(..............@....pdata..${...0...|..................@..@.rsrc...L...........................@..@.reloc..h!......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68002\yarl\_quoting_c.cp311-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):97280
                                                                                                                                                                                                                                        Entropy (8bit):5.965911733978745
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:xtuirzB429BT5WTY4yBRmWHdRfIIGrzf9NzeXzf2RUd:xtugP5y7uf9N81NzeDuRU
                                                                                                                                                                                                                                        MD5:1C6C610E5E2547981A2F14F240ACCF20
                                                                                                                                                                                                                                        SHA1:4A2438293D2F86761EF84CFDF99A6CA86604D0B8
                                                                                                                                                                                                                                        SHA-256:4A982FF53E006B462DDF7090749BC06EBB6E97578BE04169489D27E93F1D1804
                                                                                                                                                                                                                                        SHA-512:F6EA205A49BF586D7F3537D56B805D34584A4C2C7D75A81C53CE457A4A438590F6DBEDED324362BFE18B86FF5696673DE5FBE4C9759AD121B5E4C9AE2EF267C0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:m.]~...~...~...wt..z...n...|...5t..|...n...}...n...v...n...r.......}...~.......5.......5.......5.g.....5.......Rich~...........................PE..d....."g.........." ...)............P.....................................................`..........................................Y..d....Z..x...............................,....G...............................F..@............ ...............................text............................... ..`.rdata...N... ...P..................@..@.data...P7...p.......`..............@....pdata...............l..............@..@.rsrc................x..............@..@.reloc..,............z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\gen_py\3.11\__init__.py

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):176
                                                                                                                                                                                                                                        Entropy (8bit):4.713840781302666
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
                                                                                                                                                                                                                                        MD5:8C7CA775CF482C6027B4A2D3DB0F6A31
                                                                                                                                                                                                                                        SHA1:E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
                                                                                                                                                                                                                                        SHA-256:52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
                                                                                                                                                                                                                                        SHA-512:19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\gen_py\3.11\dicts.dat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10
                                                                                                                                                                                                                                        Entropy (8bit):2.7219280948873625
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:qW6:qW6
                                                                                                                                                                                                                                        MD5:2C7344F3031A5107275CE84AED227411
                                                                                                                                                                                                                                        SHA1:68ACAD72A154CBE8B2D597655FF84FD31D57C43B
                                                                                                                                                                                                                                        SHA-256:83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
                                                                                                                                                                                                                                        SHA-512:F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..K....}..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                        Size (bytes):26241148
                                                                                                                                                                                                                                        Entropy (8bit):7.997562044271756
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:786432:i9YiJVl8ZMj3hr8AW+e5RP96R+c+U4VdF5Kd:i98a3hr8AW+eHPgR6U4VdXKd
                                                                                                                                                                                                                                        MD5:A0044986EEC99F4B05358F1457BE6EE8
                                                                                                                                                                                                                                        SHA1:BED5076D966B94C942487FD04E7074E861235BA2
                                                                                                                                                                                                                                        SHA-256:24C7C6CC3124B20C717AC485E263193E351F0AB2E672B353B38688BA218BDA9A
                                                                                                                                                                                                                                        SHA-512:3DDB80BB5957CF514180692550FC5E3A916CB75D0CB99433924399F8185C0466EAF5DEB6C77CB92DAEE3E9EEC251A4479DFDF7968BD55BB47645A24D596860C3
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..*\.Z*\.Z*\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z*\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d.....1g.........."....).....\.................@....................................34....`.................................................\...x....p.......@..P"...........p..d...................................@...@............................................text............................... ..`.rdata..P*.......,..................@..@.data....S..........................@....pdata..P"...@...$..................@..@.rsrc........p......................@..@.reloc..d....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Entropy (8bit):7.997562044271756
                                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                                        • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                        • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                        File name:Payload.exe
                                                                                                                                                                                                                                        File size:26'241'148 bytes
                                                                                                                                                                                                                                        MD5:a0044986eec99f4b05358f1457be6ee8
                                                                                                                                                                                                                                        SHA1:bed5076d966b94c942487fd04e7074e861235ba2
                                                                                                                                                                                                                                        SHA256:24c7c6cc3124b20c717ac485e263193e351f0ab2e672b353b38688ba218bda9a
                                                                                                                                                                                                                                        SHA512:3ddb80bb5957cf514180692550fc5e3a916cb75d0cb99433924399f8185c0466eaf5deb6c77cb92daee3e9eec251a4479dfdf7968bd55bb47645a24d596860c3
                                                                                                                                                                                                                                        SSDEEP:786432:i9YiJVl8ZMj3hr8AW+e5RP96R+c+U4VdF5Kd:i98a3hr8AW+eHPgR6U4VdXKd
                                                                                                                                                                                                                                        TLSH:9047339952E90CD2ECF5413AC22AC109BB32FE656BD0D54F9BF988471FA72D01D39E81
                                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..*\.Z*\.Z*\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z*\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

                                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                                        Icon Hash:4a464cd47461e179

                                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Entrypoint:0x14000cdb0
                                                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                                                        Imagebase:0x140000000
                                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                        Time Stamp:0x6731F8C8 [Mon Nov 11 12:30:00 2024 UTC]
                                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                                        OS Version Major:6
                                                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                                                        File Version Major:6
                                                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                                                        Subsystem Version Major:6
                                                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                                                        Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                                                        call 00007F3E04C36F6Ch
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                                                        jmp 00007F3E04C36B8Fh
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                                                        call 00007F3E04C37338h
                                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                                        je 00007F3E04C36D33h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                        jmp 00007F3E04C36D17h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        cmp ecx, eax
                                                                                                                                                                                                                                        je 00007F3E04C36D26h
                                                                                                                                                                                                                                        xor eax, eax
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        cmpxchg dword ptr [0003577Ch], ecx
                                                                                                                                                                                                                                        jne 00007F3E04C36D00h
                                                                                                                                                                                                                                        xor al, al
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                                                        ret
                                                                                                                                                                                                                                        mov al, 01h
                                                                                                                                                                                                                                        jmp 00007F3E04C36D09h
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                                                        test ecx, ecx
                                                                                                                                                                                                                                        jne 00007F3E04C36D19h
                                                                                                                                                                                                                                        mov byte ptr [00035765h], 00000001h
                                                                                                                                                                                                                                        call 00007F3E04C36465h
                                                                                                                                                                                                                                        call 00007F3E04C37750h
                                                                                                                                                                                                                                        test al, al
                                                                                                                                                                                                                                        jne 00007F3E04C36D16h
                                                                                                                                                                                                                                        xor al, al
                                                                                                                                                                                                                                        jmp 00007F3E04C36D26h
                                                                                                                                                                                                                                        call 00007F3E04C4426Fh
                                                                                                                                                                                                                                        test al, al
                                                                                                                                                                                                                                        jne 00007F3E04C36D1Bh
                                                                                                                                                                                                                                        xor ecx, ecx
                                                                                                                                                                                                                                        call 00007F3E04C37760h
                                                                                                                                                                                                                                        jmp 00007F3E04C36CFCh
                                                                                                                                                                                                                                        mov al, 01h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                                                        ret
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        inc eax
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 20h
                                                                                                                                                                                                                                        cmp byte ptr [0003572Ch], 00000000h
                                                                                                                                                                                                                                        mov ebx, ecx
                                                                                                                                                                                                                                        jne 00007F3E04C36D79h
                                                                                                                                                                                                                                        cmp ecx, 01h
                                                                                                                                                                                                                                        jnbe 00007F3E04C36D7Ch
                                                                                                                                                                                                                                        call 00007F3E04C372AEh
                                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                                        je 00007F3E04C36D3Ah
                                                                                                                                                                                                                                        test ebx, ebx
                                                                                                                                                                                                                                        jne 00007F3E04C36D36h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        lea ecx, dword ptr [00035716h]
                                                                                                                                                                                                                                        call 00007F3E04C44062h

                                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca5c0x78.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000xf41c.rsrc
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2250.pdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x570000x764.reloc
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                        .text0x10000x29f000x2a0002a7ae207b6295492e9da088072661752False0.5514439174107143data6.487454925709845IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .rdata0x2b0000x12a500x12c00e341dab10b74e3767c73397449a4fdadFalse0.5244661458333333data5.752660729211676IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        .pdata0x440000x22500x2400f5559f14427a02f0a5dbd0dd026cae54False0.470703125data5.291665041994019IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .rsrc0x470000xf41c0xf600455788c285fcfdcb4008bc77e762818aFalse0.803099593495935data7.5549760623589695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .reloc0x570000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                        RT_ICON0x472080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                                                        RT_ICON0x480b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                                                        RT_ICON0x489580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                                                        RT_ICON0x48ec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                                                        RT_ICON0x523ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                                                        RT_ICON0x549940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                                                        RT_ICON0x55a3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                                                        RT_GROUP_ICON0x55ea40x68data0.7019230769230769
                                                                                                                                                                                                                                        RT_MANIFEST0x55f0c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                                        USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                        COMCTL32.dll
                                                                                                                                                                                                                                        KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                                                        ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                        GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                                        Suricata IDS Alerts

                                                                                                                                                                                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                                                        2024-11-13T15:59:15.003634+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.449732TCP
                                                                                                                                                                                                                                        2024-11-13T15:59:53.633022+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.449793TCP

                                                                                                                                                                                                                                        Network Port Distribution

                                                                                                                                                                                                                                        TCP Packets

                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.611741066 CET49731443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.611788988 CET44349731172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.611862898 CET49731443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.612731934 CET49731443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.612754107 CET44349731172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:11.263238907 CET44349731172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:11.267180920 CET49731443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:11.267198086 CET44349731172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:11.269326925 CET44349731172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:11.269428015 CET49731443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:11.270807981 CET49731443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:11.270977974 CET49731443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.244208097 CET49739443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.244271040 CET44349739172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.244355917 CET49739443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.245094061 CET49739443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.245106936 CET44349739172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.908715010 CET44349739172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.909660101 CET49739443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.909701109 CET44349739172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.913325071 CET44349739172.67.74.152192.168.2.4
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.913410902 CET49739443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.915364981 CET49739443192.168.2.4172.67.74.152
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:32.915577888 CET49739443192.168.2.4172.67.74.152

                                                                                                                                                                                                                                        UDP Packets

                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.585973024 CET5688253192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.593544960 CET53568821.1.1.1192.168.2.4

                                                                                                                                                                                                                                        DNS Queries

                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.585973024 CET192.168.2.41.1.1.10xdb69Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                        DNS Answers

                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.593544960 CET1.1.1.1192.168.2.40xdb69No error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.593544960 CET1.1.1.1192.168.2.40xdb69No error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Nov 13, 2024 15:59:10.593544960 CET1.1.1.1192.168.2.40xdb69No error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                                        Start time:09:58:56
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\Payload.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff6d3b40000
                                                                                                                                                                                                                                        File size:26'241'148 bytes
                                                                                                                                                                                                                                        MD5 hash:A0044986EEC99F4B05358F1457BE6EE8
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:1
                                                                                                                                                                                                                                        Start time:09:59:00
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\Payload.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff6d3b40000
                                                                                                                                                                                                                                        File size:26'241'148 bytes
                                                                                                                                                                                                                                        MD5 hash:A0044986EEC99F4B05358F1457BE6EE8
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_XLABBGrabber, Description: Yara detected XLABB Grabber, Source: 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_BLXStealer, Description: Yara detected BLX Stealer, Source: 00000001.00000002.3690970778.000001BB33190000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:2
                                                                                                                                                                                                                                        Start time:09:59:03
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                        Imagebase:0x7ff69a620000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:3
                                                                                                                                                                                                                                        Start time:09:59:03
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:4
                                                                                                                                                                                                                                        Start time:09:59:07
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                        Imagebase:0x7ff69a620000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:5
                                                                                                                                                                                                                                        Start time:09:59:07
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:6
                                                                                                                                                                                                                                        Start time:09:59:07
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                        Imagebase:0x7ff69a620000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:7
                                                                                                                                                                                                                                        Start time:09:59:07
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:8
                                                                                                                                                                                                                                        Start time:09:59:07
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                        Imagebase:0x7ff7f48d0000
                                                                                                                                                                                                                                        File size:576'000 bytes
                                                                                                                                                                                                                                        MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                                        Start time:09:59:18
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff71b400000
                                                                                                                                                                                                                                        File size:26'241'148 bytes
                                                                                                                                                                                                                                        MD5 hash:A0044986EEC99F4B05358F1457BE6EE8
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                                                        Start time:09:59:23
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff71b400000
                                                                                                                                                                                                                                        File size:26'241'148 bytes
                                                                                                                                                                                                                                        MD5 hash:A0044986EEC99F4B05358F1457BE6EE8
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_XLABBGrabber, Description: Yara detected XLABB Grabber, Source: 0000000D.00000002.3690395576.000002A26F240000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_BLXStealer, Description: Yara detected BLX Stealer, Source: 0000000D.00000002.3690395576.000002A26F240000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:14
                                                                                                                                                                                                                                        Start time:09:59:26
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                        Imagebase:0x7ff69a620000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:15
                                                                                                                                                                                                                                        Start time:09:59:26
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:16
                                                                                                                                                                                                                                        Start time:09:59:29
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                        Imagebase:0x7ff69a620000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:17
                                                                                                                                                                                                                                        Start time:09:59:29
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                                        Start time:09:59:29
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                        Imagebase:0x7ff69a620000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                                        Start time:09:59:29
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:20
                                                                                                                                                                                                                                        Start time:09:59:29
                                                                                                                                                                                                                                        Start date:13/11/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                        Imagebase:0x7ff7f48d0000
                                                                                                                                                                                                                                        File size:576'000 bytes
                                                                                                                                                                                                                                        MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                          Execution Coverage:9.5%
                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                          Signature Coverage:20.1%
                                                                                                                                                                                                                                          Total number of Nodes:2000
                                                                                                                                                                                                                                          Total number of Limit Nodes:28
                                                                                                                                                                                                                                          execution_graph 20210 7ff6d3b6adfe 20211 7ff6d3b6ae0d 20210->20211 20213 7ff6d3b6ae17 20210->20213 20214 7ff6d3b60338 LeaveCriticalSection 20211->20214 18699 7ff6d3b5f98c 18700 7ff6d3b5fb7e 18699->18700 18704 7ff6d3b5f9ce _isindst 18699->18704 18701 7ff6d3b54f08 _get_daylight 11 API calls 18700->18701 18719 7ff6d3b5fb6e 18701->18719 18702 7ff6d3b4c550 _log10_special 8 API calls 18703 7ff6d3b5fb99 18702->18703 18704->18700 18705 7ff6d3b5fa4e _isindst 18704->18705 18720 7ff6d3b66194 18705->18720 18710 7ff6d3b5fbaa 18711 7ff6d3b5a900 _isindst 17 API calls 18710->18711 18713 7ff6d3b5fbbe 18711->18713 18717 7ff6d3b5faab 18717->18719 18744 7ff6d3b661d8 18717->18744 18719->18702 18721 7ff6d3b661a3 18720->18721 18722 7ff6d3b5fa6c 18720->18722 18751 7ff6d3b602d8 EnterCriticalSection 18721->18751 18726 7ff6d3b65598 18722->18726 18727 7ff6d3b5fa81 18726->18727 18728 7ff6d3b655a1 18726->18728 18727->18710 18732 7ff6d3b655c8 18727->18732 18729 7ff6d3b54f08 _get_daylight 11 API calls 18728->18729 18730 7ff6d3b655a6 18729->18730 18731 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 18730->18731 18731->18727 18733 7ff6d3b5fa92 18732->18733 18734 7ff6d3b655d1 18732->18734 18733->18710 18738 7ff6d3b655f8 18733->18738 18735 7ff6d3b54f08 _get_daylight 11 API calls 18734->18735 18736 7ff6d3b655d6 18735->18736 18737 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 18736->18737 18737->18733 18739 7ff6d3b5faa3 18738->18739 18740 7ff6d3b65601 18738->18740 18739->18710 18739->18717 18741 7ff6d3b54f08 _get_daylight 11 API calls 18740->18741 18742 7ff6d3b65606 18741->18742 18743 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 18742->18743 18743->18739 18752 7ff6d3b602d8 EnterCriticalSection 18744->18752 20224 7ff6d3b55410 20225 7ff6d3b5541b 20224->20225 20233 7ff6d3b5f2a4 20225->20233 20246 7ff6d3b602d8 EnterCriticalSection 20233->20246 19559 7ff6d3b5c520 19570 7ff6d3b602d8 EnterCriticalSection 19559->19570 18753 7ff6d3b55628 18754 7ff6d3b55642 18753->18754 18755 7ff6d3b5565f 18753->18755 18756 7ff6d3b54ee8 _fread_nolock 11 API calls 18754->18756 18755->18754 18757 7ff6d3b55672 CreateFileW 18755->18757 18758 7ff6d3b55647 18756->18758 18759 7ff6d3b556dc 18757->18759 18760 7ff6d3b556a6 18757->18760 18763 7ff6d3b54f08 _get_daylight 11 API calls 18758->18763 18804 7ff6d3b55c04 18759->18804 18778 7ff6d3b5577c GetFileType 18760->18778 18766 7ff6d3b5564f 18763->18766 18771 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 18766->18771 18767 7ff6d3b556bb CloseHandle 18773 7ff6d3b5565a 18767->18773 18768 7ff6d3b556d1 CloseHandle 18768->18773 18769 7ff6d3b556e5 18772 7ff6d3b54e7c _fread_nolock 11 API calls 18769->18772 18770 7ff6d3b55710 18825 7ff6d3b559c4 18770->18825 18771->18773 18777 7ff6d3b556ef 18772->18777 18777->18773 18779 7ff6d3b557ca 18778->18779 18780 7ff6d3b55887 18778->18780 18781 7ff6d3b557f6 GetFileInformationByHandle 18779->18781 18784 7ff6d3b55b00 21 API calls 18779->18784 18782 7ff6d3b5588f 18780->18782 18783 7ff6d3b558b1 18780->18783 18785 7ff6d3b558a2 GetLastError 18781->18785 18786 7ff6d3b5581f 18781->18786 18782->18785 18787 7ff6d3b55893 18782->18787 18788 7ff6d3b558d4 PeekNamedPipe 18783->18788 18803 7ff6d3b55872 18783->18803 18789 7ff6d3b557e4 18784->18789 18792 7ff6d3b54e7c _fread_nolock 11 API calls 18785->18792 18790 7ff6d3b559c4 51 API calls 18786->18790 18791 7ff6d3b54f08 _get_daylight 11 API calls 18787->18791 18788->18803 18789->18781 18789->18803 18794 7ff6d3b5582a 18790->18794 18791->18803 18792->18803 18793 7ff6d3b4c550 _log10_special 8 API calls 18795 7ff6d3b556b4 18793->18795 18842 7ff6d3b55924 18794->18842 18795->18767 18795->18768 18798 7ff6d3b55924 10 API calls 18799 7ff6d3b55849 18798->18799 18800 7ff6d3b55924 10 API calls 18799->18800 18801 7ff6d3b5585a 18800->18801 18802 7ff6d3b54f08 _get_daylight 11 API calls 18801->18802 18801->18803 18802->18803 18803->18793 18805 7ff6d3b55c3a 18804->18805 18806 7ff6d3b54f08 _get_daylight 11 API calls 18805->18806 18819 7ff6d3b55cd2 __std_exception_destroy 18805->18819 18808 7ff6d3b55c4c 18806->18808 18807 7ff6d3b4c550 _log10_special 8 API calls 18809 7ff6d3b556e1 18807->18809 18810 7ff6d3b54f08 _get_daylight 11 API calls 18808->18810 18809->18769 18809->18770 18811 7ff6d3b55c54 18810->18811 18812 7ff6d3b57e08 45 API calls 18811->18812 18813 7ff6d3b55c69 18812->18813 18814 7ff6d3b55c7b 18813->18814 18815 7ff6d3b55c71 18813->18815 18817 7ff6d3b54f08 _get_daylight 11 API calls 18814->18817 18816 7ff6d3b54f08 _get_daylight 11 API calls 18815->18816 18824 7ff6d3b55c76 18816->18824 18818 7ff6d3b55c80 18817->18818 18818->18819 18820 7ff6d3b54f08 _get_daylight 11 API calls 18818->18820 18819->18807 18821 7ff6d3b55c8a 18820->18821 18822 7ff6d3b57e08 45 API calls 18821->18822 18822->18824 18823 7ff6d3b55cc4 GetDriveTypeW 18823->18819 18824->18819 18824->18823 18826 7ff6d3b559ec 18825->18826 18834 7ff6d3b5571d 18826->18834 18849 7ff6d3b5f724 18826->18849 18828 7ff6d3b55a80 18829 7ff6d3b5f724 51 API calls 18828->18829 18828->18834 18830 7ff6d3b55a93 18829->18830 18831 7ff6d3b5f724 51 API calls 18830->18831 18830->18834 18832 7ff6d3b55aa6 18831->18832 18833 7ff6d3b5f724 51 API calls 18832->18833 18832->18834 18833->18834 18835 7ff6d3b55b00 18834->18835 18836 7ff6d3b55b1a 18835->18836 18837 7ff6d3b55b51 18836->18837 18838 7ff6d3b55b2a 18836->18838 18840 7ff6d3b5f5b8 21 API calls 18837->18840 18839 7ff6d3b55b3a 18838->18839 18841 7ff6d3b54e7c _fread_nolock 11 API calls 18838->18841 18839->18777 18840->18839 18841->18839 18843 7ff6d3b5594d FileTimeToSystemTime 18842->18843 18844 7ff6d3b55940 18842->18844 18845 7ff6d3b55961 SystemTimeToTzSpecificLocalTime 18843->18845 18847 7ff6d3b55948 18843->18847 18844->18843 18844->18847 18845->18847 18846 7ff6d3b4c550 _log10_special 8 API calls 18848 7ff6d3b55839 18846->18848 18847->18846 18848->18798 18850 7ff6d3b5f755 18849->18850 18851 7ff6d3b5f731 18849->18851 18853 7ff6d3b5f78f 18850->18853 18856 7ff6d3b5f7ae 18850->18856 18851->18850 18852 7ff6d3b5f736 18851->18852 18854 7ff6d3b54f08 _get_daylight 11 API calls 18852->18854 18855 7ff6d3b54f08 _get_daylight 11 API calls 18853->18855 18857 7ff6d3b5f73b 18854->18857 18858 7ff6d3b5f794 18855->18858 18859 7ff6d3b54f4c 45 API calls 18856->18859 18860 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 18857->18860 18861 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 18858->18861 18864 7ff6d3b5f7bb 18859->18864 18862 7ff6d3b5f746 18860->18862 18863 7ff6d3b5f79f 18861->18863 18862->18828 18863->18828 18864->18863 18865 7ff6d3b604dc 51 API calls 18864->18865 18865->18864 20069 7ff6d3b616b0 20080 7ff6d3b673e4 20069->20080 20081 7ff6d3b673f1 20080->20081 20082 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20081->20082 20083 7ff6d3b6740d 20081->20083 20082->20081 20084 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20083->20084 20085 7ff6d3b616b9 20083->20085 20084->20083 20086 7ff6d3b602d8 EnterCriticalSection 20085->20086 15895 7ff6d3b4cc3c 15916 7ff6d3b4ce0c 15895->15916 15898 7ff6d3b4cd88 16070 7ff6d3b4d12c IsProcessorFeaturePresent 15898->16070 15899 7ff6d3b4cc58 __scrt_acquire_startup_lock 15901 7ff6d3b4cd92 15899->15901 15908 7ff6d3b4cc76 __scrt_release_startup_lock 15899->15908 15902 7ff6d3b4d12c 7 API calls 15901->15902 15904 7ff6d3b4cd9d __GetCurrentState 15902->15904 15903 7ff6d3b4cc9b 15905 7ff6d3b4cd21 15922 7ff6d3b4d274 15905->15922 15907 7ff6d3b4cd26 15925 7ff6d3b41000 15907->15925 15908->15903 15908->15905 16059 7ff6d3b59b2c 15908->16059 15913 7ff6d3b4cd49 15913->15904 16066 7ff6d3b4cf90 15913->16066 15917 7ff6d3b4ce14 15916->15917 15918 7ff6d3b4ce20 __scrt_dllmain_crt_thread_attach 15917->15918 15919 7ff6d3b4cc50 15918->15919 15920 7ff6d3b4ce2d 15918->15920 15919->15898 15919->15899 15920->15919 16077 7ff6d3b4d888 15920->16077 16104 7ff6d3b6a4d0 15922->16104 15926 7ff6d3b41009 15925->15926 16106 7ff6d3b55484 15926->16106 15928 7ff6d3b437fb 16113 7ff6d3b436b0 15928->16113 15934 7ff6d3b4383c 16273 7ff6d3b41c80 15934->16273 15935 7ff6d3b4391b 16282 7ff6d3b445c0 15935->16282 15939 7ff6d3b4385b 16185 7ff6d3b48830 15939->16185 15942 7ff6d3b4396a 16305 7ff6d3b42710 15942->16305 15944 7ff6d3b4388e 15953 7ff6d3b438bb __std_exception_destroy 15944->15953 16277 7ff6d3b489a0 15944->16277 15946 7ff6d3b4395d 15947 7ff6d3b43984 15946->15947 15948 7ff6d3b43962 15946->15948 15950 7ff6d3b41c80 49 API calls 15947->15950 16301 7ff6d3b5004c 15948->16301 15952 7ff6d3b439a3 15950->15952 15958 7ff6d3b41950 115 API calls 15952->15958 15954 7ff6d3b48830 14 API calls 15953->15954 15961 7ff6d3b438de __std_exception_destroy 15953->15961 15954->15961 15956 7ff6d3b43a0b 15957 7ff6d3b489a0 40 API calls 15956->15957 15959 7ff6d3b43a17 15957->15959 15960 7ff6d3b439ce 15958->15960 15962 7ff6d3b489a0 40 API calls 15959->15962 15960->15939 15963 7ff6d3b439de 15960->15963 15967 7ff6d3b4390e __std_exception_destroy 15961->15967 16316 7ff6d3b48940 15961->16316 15964 7ff6d3b43a23 15962->15964 15965 7ff6d3b42710 54 API calls 15963->15965 15966 7ff6d3b489a0 40 API calls 15964->15966 15973 7ff6d3b43808 __std_exception_destroy 15965->15973 15966->15967 15968 7ff6d3b48830 14 API calls 15967->15968 15969 7ff6d3b43a3b 15968->15969 15970 7ff6d3b43a60 __std_exception_destroy 15969->15970 15971 7ff6d3b43b2f 15969->15971 15974 7ff6d3b48940 40 API calls 15970->15974 15985 7ff6d3b43aab 15970->15985 15972 7ff6d3b42710 54 API calls 15971->15972 15972->15973 16323 7ff6d3b4c550 15973->16323 15974->15985 15975 7ff6d3b48830 14 API calls 15976 7ff6d3b43bf4 __std_exception_destroy 15975->15976 15977 7ff6d3b43c46 15976->15977 15978 7ff6d3b43d41 15976->15978 15979 7ff6d3b43c50 15977->15979 15980 7ff6d3b43cd4 15977->15980 16332 7ff6d3b444e0 15978->16332 16198 7ff6d3b490e0 15979->16198 15983 7ff6d3b48830 14 API calls 15980->15983 15987 7ff6d3b43ce0 15983->15987 15984 7ff6d3b43d4f 15988 7ff6d3b43d71 15984->15988 15989 7ff6d3b43d65 15984->15989 15985->15975 15990 7ff6d3b43c61 15987->15990 15993 7ff6d3b43ced 15987->15993 15992 7ff6d3b41c80 49 API calls 15988->15992 16335 7ff6d3b44630 15989->16335 15995 7ff6d3b42710 54 API calls 15990->15995 16001 7ff6d3b43cc8 __std_exception_destroy 15992->16001 15996 7ff6d3b41c80 49 API calls 15993->15996 15995->15973 15999 7ff6d3b43d0b 15996->15999 15997 7ff6d3b43dc4 16248 7ff6d3b49390 15997->16248 15999->16001 16002 7ff6d3b43d12 15999->16002 16001->15997 16003 7ff6d3b43da7 SetDllDirectoryW LoadLibraryExW 16001->16003 16006 7ff6d3b42710 54 API calls 16002->16006 16003->15997 16004 7ff6d3b43dd7 SetDllDirectoryW 16007 7ff6d3b43e0a 16004->16007 16049 7ff6d3b43e5a 16004->16049 16006->15973 16008 7ff6d3b48830 14 API calls 16007->16008 16016 7ff6d3b43e16 __std_exception_destroy 16008->16016 16009 7ff6d3b44008 16010 7ff6d3b44035 16009->16010 16011 7ff6d3b44012 PostMessageW GetMessageW 16009->16011 16412 7ff6d3b43360 16010->16412 16011->16010 16012 7ff6d3b43f1b 16253 7ff6d3b433c0 16012->16253 16019 7ff6d3b43ef2 16016->16019 16023 7ff6d3b43e4e 16016->16023 16022 7ff6d3b48940 40 API calls 16019->16022 16022->16049 16023->16049 16338 7ff6d3b46dc0 16023->16338 16049->16009 16049->16012 16060 7ff6d3b59b43 16059->16060 16061 7ff6d3b59b64 16059->16061 16060->15905 18650 7ff6d3b5a3d8 16061->18650 16064 7ff6d3b4d2b8 GetModuleHandleW 16065 7ff6d3b4d2c9 16064->16065 16065->15913 16067 7ff6d3b4cfa1 16066->16067 16068 7ff6d3b4cd60 16067->16068 16069 7ff6d3b4d888 7 API calls 16067->16069 16068->15903 16069->16068 16071 7ff6d3b4d152 __GetCurrentState memcpy_s 16070->16071 16072 7ff6d3b4d171 RtlCaptureContext RtlLookupFunctionEntry 16071->16072 16073 7ff6d3b4d19a RtlVirtualUnwind 16072->16073 16074 7ff6d3b4d1d6 memcpy_s 16072->16074 16073->16074 16075 7ff6d3b4d208 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16074->16075 16076 7ff6d3b4d256 __GetCurrentState 16075->16076 16076->15901 16078 7ff6d3b4d89a 16077->16078 16079 7ff6d3b4d890 16077->16079 16078->15919 16083 7ff6d3b4dc24 16079->16083 16084 7ff6d3b4dc33 16083->16084 16085 7ff6d3b4d895 16083->16085 16091 7ff6d3b4de60 16084->16091 16087 7ff6d3b4dc90 16085->16087 16088 7ff6d3b4dcbb 16087->16088 16089 7ff6d3b4dc9e DeleteCriticalSection 16088->16089 16090 7ff6d3b4dcbf 16088->16090 16089->16088 16090->16078 16095 7ff6d3b4dcc8 16091->16095 16096 7ff6d3b4dd0c __vcrt_InitializeCriticalSectionEx 16095->16096 16102 7ff6d3b4ddb2 TlsFree 16095->16102 16097 7ff6d3b4dd3a LoadLibraryExW 16096->16097 16100 7ff6d3b4ddf9 GetProcAddress 16096->16100 16096->16102 16103 7ff6d3b4dd7d LoadLibraryExW 16096->16103 16098 7ff6d3b4dd5b GetLastError 16097->16098 16099 7ff6d3b4ddd9 16097->16099 16098->16096 16099->16100 16101 7ff6d3b4ddf0 FreeLibrary 16099->16101 16100->16102 16101->16100 16103->16096 16103->16099 16105 7ff6d3b4d28b GetStartupInfoW 16104->16105 16105->15907 16109 7ff6d3b5f480 16106->16109 16107 7ff6d3b5f4d3 16425 7ff6d3b5a814 16107->16425 16109->16107 16110 7ff6d3b5f526 16109->16110 16435 7ff6d3b5f358 16110->16435 16112 7ff6d3b5f4fc 16112->15928 16544 7ff6d3b4c850 16113->16544 16115 7ff6d3b436bc GetModuleFileNameW 16116 7ff6d3b436eb GetLastError 16115->16116 16117 7ff6d3b43710 16115->16117 16551 7ff6d3b42c50 16116->16551 16546 7ff6d3b49280 FindFirstFileExW 16117->16546 16121 7ff6d3b43706 16125 7ff6d3b4c550 _log10_special 8 API calls 16121->16125 16122 7ff6d3b4377d 16577 7ff6d3b49440 16122->16577 16123 7ff6d3b43723 16566 7ff6d3b49300 CreateFileW 16123->16566 16128 7ff6d3b437b5 16125->16128 16127 7ff6d3b4378b 16127->16121 16133 7ff6d3b42810 49 API calls 16127->16133 16128->15973 16135 7ff6d3b41950 16128->16135 16130 7ff6d3b4374c __vcrt_InitializeCriticalSectionEx 16130->16122 16131 7ff6d3b43734 16569 7ff6d3b42810 16131->16569 16133->16121 16136 7ff6d3b445c0 108 API calls 16135->16136 16137 7ff6d3b41985 16136->16137 16138 7ff6d3b41c43 16137->16138 16139 7ff6d3b47f90 83 API calls 16137->16139 16140 7ff6d3b4c550 _log10_special 8 API calls 16138->16140 16141 7ff6d3b419cb 16139->16141 16142 7ff6d3b41c5e 16140->16142 16184 7ff6d3b41a03 16141->16184 16982 7ff6d3b506d4 16141->16982 16142->15934 16142->15935 16144 7ff6d3b5004c 74 API calls 16144->16138 16145 7ff6d3b419e5 16146 7ff6d3b419e9 16145->16146 16147 7ff6d3b41a08 16145->16147 16149 7ff6d3b54f08 _get_daylight 11 API calls 16146->16149 16986 7ff6d3b5039c 16147->16986 16151 7ff6d3b419ee 16149->16151 16989 7ff6d3b42910 16151->16989 16152 7ff6d3b41a26 16155 7ff6d3b54f08 _get_daylight 11 API calls 16152->16155 16153 7ff6d3b41a45 16158 7ff6d3b41a5c 16153->16158 16159 7ff6d3b41a7b 16153->16159 16156 7ff6d3b41a2b 16155->16156 16157 7ff6d3b42910 54 API calls 16156->16157 16157->16184 16161 7ff6d3b54f08 _get_daylight 11 API calls 16158->16161 16160 7ff6d3b41c80 49 API calls 16159->16160 16162 7ff6d3b41a92 16160->16162 16163 7ff6d3b41a61 16161->16163 16164 7ff6d3b41c80 49 API calls 16162->16164 16165 7ff6d3b42910 54 API calls 16163->16165 16166 7ff6d3b41add 16164->16166 16165->16184 16167 7ff6d3b506d4 73 API calls 16166->16167 16168 7ff6d3b41b01 16167->16168 16169 7ff6d3b41b16 16168->16169 16170 7ff6d3b41b35 16168->16170 16171 7ff6d3b54f08 _get_daylight 11 API calls 16169->16171 16172 7ff6d3b5039c _fread_nolock 53 API calls 16170->16172 16174 7ff6d3b41b1b 16171->16174 16173 7ff6d3b41b4a 16172->16173 16175 7ff6d3b41b50 16173->16175 16176 7ff6d3b41b6f 16173->16176 16177 7ff6d3b42910 54 API calls 16174->16177 16178 7ff6d3b54f08 _get_daylight 11 API calls 16175->16178 17004 7ff6d3b50110 16176->17004 16177->16184 16180 7ff6d3b41b55 16178->16180 16182 7ff6d3b42910 54 API calls 16180->16182 16182->16184 16183 7ff6d3b42710 54 API calls 16183->16184 16184->16144 16186 7ff6d3b4883a 16185->16186 16187 7ff6d3b49390 2 API calls 16186->16187 16188 7ff6d3b48859 GetEnvironmentVariableW 16187->16188 16189 7ff6d3b48876 ExpandEnvironmentStringsW 16188->16189 16190 7ff6d3b488c2 16188->16190 16189->16190 16191 7ff6d3b48898 16189->16191 16192 7ff6d3b4c550 _log10_special 8 API calls 16190->16192 16193 7ff6d3b49440 2 API calls 16191->16193 16194 7ff6d3b488d4 16192->16194 16195 7ff6d3b488aa 16193->16195 16194->15944 16196 7ff6d3b4c550 _log10_special 8 API calls 16195->16196 16197 7ff6d3b488ba 16196->16197 16197->15944 16199 7ff6d3b490f5 16198->16199 17222 7ff6d3b48570 GetCurrentProcess OpenProcessToken 16199->17222 16202 7ff6d3b48570 7 API calls 16203 7ff6d3b49121 16202->16203 16204 7ff6d3b4913a 16203->16204 16205 7ff6d3b49154 16203->16205 16207 7ff6d3b426b0 48 API calls 16204->16207 16206 7ff6d3b426b0 48 API calls 16205->16206 16209 7ff6d3b49167 LocalFree LocalFree 16206->16209 16208 7ff6d3b49152 16207->16208 16208->16209 16210 7ff6d3b49183 16209->16210 16212 7ff6d3b4918f 16209->16212 17232 7ff6d3b42b50 16210->17232 16213 7ff6d3b4c550 _log10_special 8 API calls 16212->16213 16214 7ff6d3b43c55 16213->16214 16214->15990 16215 7ff6d3b48660 16214->16215 16216 7ff6d3b48678 16215->16216 16217 7ff6d3b486fa GetTempPathW GetCurrentProcessId 16216->16217 16218 7ff6d3b4869c 16216->16218 17241 7ff6d3b425c0 16217->17241 16220 7ff6d3b48830 14 API calls 16218->16220 16221 7ff6d3b486a8 16220->16221 17248 7ff6d3b481d0 16221->17248 16228 7ff6d3b48728 __std_exception_destroy 16234 7ff6d3b48765 __std_exception_destroy 16228->16234 17245 7ff6d3b58b68 16228->17245 16233 7ff6d3b4c550 _log10_special 8 API calls 16235 7ff6d3b43cbb 16233->16235 16239 7ff6d3b49390 2 API calls 16234->16239 16247 7ff6d3b487d4 __std_exception_destroy 16234->16247 16235->15990 16235->16001 16240 7ff6d3b487b1 16239->16240 16241 7ff6d3b487b6 16240->16241 16242 7ff6d3b487e9 16240->16242 16243 7ff6d3b49390 2 API calls 16241->16243 16244 7ff6d3b58238 38 API calls 16242->16244 16244->16247 16247->16233 16249 7ff6d3b493b2 MultiByteToWideChar 16248->16249 16250 7ff6d3b493d6 16248->16250 16249->16250 16252 7ff6d3b493ec __std_exception_destroy 16249->16252 16251 7ff6d3b493f3 MultiByteToWideChar 16250->16251 16250->16252 16251->16252 16252->16004 16269 7ff6d3b433ce memcpy_s 16253->16269 16254 7ff6d3b4c550 _log10_special 8 API calls 16255 7ff6d3b43664 16254->16255 16255->15973 16272 7ff6d3b490c0 LocalFree 16255->16272 16257 7ff6d3b41c80 49 API calls 16257->16269 16258 7ff6d3b435e2 16260 7ff6d3b42710 54 API calls 16258->16260 16266 7ff6d3b435c7 16260->16266 16263 7ff6d3b435c9 16265 7ff6d3b42710 54 API calls 16263->16265 16264 7ff6d3b42a50 54 API calls 16264->16269 16265->16266 16266->16254 16269->16257 16269->16258 16269->16263 16269->16264 16269->16266 16270 7ff6d3b435d0 16269->16270 17537 7ff6d3b44560 16269->17537 17543 7ff6d3b47e20 16269->17543 17554 7ff6d3b41600 16269->17554 17602 7ff6d3b47120 16269->17602 17606 7ff6d3b44190 16269->17606 17650 7ff6d3b44450 16269->17650 16271 7ff6d3b42710 54 API calls 16270->16271 16271->16266 16274 7ff6d3b41ca5 16273->16274 16275 7ff6d3b54984 49 API calls 16274->16275 16276 7ff6d3b41cc8 16275->16276 16276->15939 16278 7ff6d3b49390 2 API calls 16277->16278 16279 7ff6d3b489b4 16278->16279 16280 7ff6d3b58238 38 API calls 16279->16280 16281 7ff6d3b489c6 __std_exception_destroy 16280->16281 16281->15953 16283 7ff6d3b445cc 16282->16283 16284 7ff6d3b49390 2 API calls 16283->16284 16285 7ff6d3b445f4 16284->16285 16286 7ff6d3b49390 2 API calls 16285->16286 16287 7ff6d3b44607 16286->16287 17833 7ff6d3b55f94 16287->17833 16290 7ff6d3b4c550 _log10_special 8 API calls 16291 7ff6d3b4392b 16290->16291 16291->15942 16292 7ff6d3b47f90 16291->16292 16293 7ff6d3b47fb4 16292->16293 16294 7ff6d3b506d4 73 API calls 16293->16294 16299 7ff6d3b4808b __std_exception_destroy 16293->16299 16295 7ff6d3b47fd0 16294->16295 16295->16299 18224 7ff6d3b578c8 16295->18224 16297 7ff6d3b506d4 73 API calls 16300 7ff6d3b47fe5 16297->16300 16298 7ff6d3b5039c _fread_nolock 53 API calls 16298->16300 16299->15946 16300->16297 16300->16298 16300->16299 16302 7ff6d3b5007c 16301->16302 18239 7ff6d3b4fe28 16302->18239 16304 7ff6d3b50095 16304->15942 16306 7ff6d3b4c850 16305->16306 16307 7ff6d3b42734 GetCurrentProcessId 16306->16307 16308 7ff6d3b41c80 49 API calls 16307->16308 16309 7ff6d3b42787 16308->16309 16310 7ff6d3b54984 49 API calls 16309->16310 16311 7ff6d3b427cf 16310->16311 16312 7ff6d3b42620 12 API calls 16311->16312 16313 7ff6d3b427f1 16312->16313 16314 7ff6d3b4c550 _log10_special 8 API calls 16313->16314 16315 7ff6d3b42801 16314->16315 16315->15973 16317 7ff6d3b49390 2 API calls 16316->16317 16318 7ff6d3b4895c 16317->16318 16319 7ff6d3b49390 2 API calls 16318->16319 16320 7ff6d3b4896c 16319->16320 16321 7ff6d3b58238 38 API calls 16320->16321 16322 7ff6d3b4897a __std_exception_destroy 16321->16322 16322->15956 16324 7ff6d3b4c559 16323->16324 16325 7ff6d3b4c8e0 IsProcessorFeaturePresent 16324->16325 16326 7ff6d3b43ca7 16324->16326 16327 7ff6d3b4c8f8 16325->16327 16326->16064 18250 7ff6d3b4cad8 RtlCaptureContext 16327->18250 16333 7ff6d3b41c80 49 API calls 16332->16333 16334 7ff6d3b444fd 16333->16334 16334->15984 16336 7ff6d3b41c80 49 API calls 16335->16336 16337 7ff6d3b44660 16336->16337 16337->16001 16337->16337 16339 7ff6d3b46dd5 16338->16339 16340 7ff6d3b43e6c 16339->16340 16341 7ff6d3b54f08 _get_daylight 11 API calls 16339->16341 16344 7ff6d3b47340 16340->16344 16342 7ff6d3b46de2 16341->16342 16343 7ff6d3b42910 54 API calls 16342->16343 16343->16340 18255 7ff6d3b41470 16344->18255 16346 7ff6d3b47368 16347 7ff6d3b474b9 __std_exception_destroy 16346->16347 16348 7ff6d3b44630 49 API calls 16346->16348 18361 7ff6d3b46360 16412->18361 16420 7ff6d3b43399 16421 7ff6d3b43670 16420->16421 16442 7ff6d3b5a55c 16425->16442 16429 7ff6d3b5a84f 16429->16112 16543 7ff6d3b5546c EnterCriticalSection 16435->16543 16443 7ff6d3b5a578 GetLastError 16442->16443 16444 7ff6d3b5a5b3 16442->16444 16445 7ff6d3b5a588 16443->16445 16444->16429 16448 7ff6d3b5a5c8 16444->16448 16455 7ff6d3b5b390 16445->16455 16449 7ff6d3b5a5fc 16448->16449 16450 7ff6d3b5a5e4 GetLastError SetLastError 16448->16450 16449->16429 16451 7ff6d3b5a900 IsProcessorFeaturePresent 16449->16451 16450->16449 16452 7ff6d3b5a913 16451->16452 16535 7ff6d3b5a614 16452->16535 16456 7ff6d3b5b3ca FlsSetValue 16455->16456 16457 7ff6d3b5b3af FlsGetValue 16455->16457 16458 7ff6d3b5a5a3 SetLastError 16456->16458 16460 7ff6d3b5b3d7 16456->16460 16457->16458 16459 7ff6d3b5b3c4 16457->16459 16458->16444 16459->16456 16472 7ff6d3b5eb98 16460->16472 16463 7ff6d3b5b404 FlsSetValue 16465 7ff6d3b5b422 16463->16465 16466 7ff6d3b5b410 FlsSetValue 16463->16466 16464 7ff6d3b5b3f4 FlsSetValue 16467 7ff6d3b5b3fd 16464->16467 16487 7ff6d3b5aef4 16465->16487 16466->16467 16481 7ff6d3b5a948 16467->16481 16473 7ff6d3b5ebb7 _get_daylight 16472->16473 16474 7ff6d3b5eba9 16472->16474 16475 7ff6d3b5ebfa 16473->16475 16476 7ff6d3b5ebde HeapAlloc 16473->16476 16492 7ff6d3b63590 16473->16492 16474->16473 16474->16475 16495 7ff6d3b54f08 16475->16495 16476->16473 16477 7ff6d3b5ebf8 16476->16477 16479 7ff6d3b5b3e6 16477->16479 16479->16463 16479->16464 16482 7ff6d3b5a94d RtlFreeHeap 16481->16482 16483 7ff6d3b5a97c 16481->16483 16482->16483 16484 7ff6d3b5a968 GetLastError 16482->16484 16483->16458 16485 7ff6d3b5a975 Concurrency::details::SchedulerProxy::DeleteThis 16484->16485 16486 7ff6d3b54f08 _get_daylight 9 API calls 16485->16486 16486->16483 16521 7ff6d3b5adcc 16487->16521 16498 7ff6d3b635d0 16492->16498 16504 7ff6d3b5b2c8 GetLastError 16495->16504 16497 7ff6d3b54f11 16497->16479 16503 7ff6d3b602d8 EnterCriticalSection 16498->16503 16505 7ff6d3b5b309 FlsSetValue 16504->16505 16510 7ff6d3b5b2ec 16504->16510 16506 7ff6d3b5b31b 16505->16506 16509 7ff6d3b5b2f9 16505->16509 16508 7ff6d3b5eb98 _get_daylight 5 API calls 16506->16508 16507 7ff6d3b5b375 SetLastError 16507->16497 16511 7ff6d3b5b32a 16508->16511 16509->16507 16510->16505 16510->16509 16512 7ff6d3b5b348 FlsSetValue 16511->16512 16513 7ff6d3b5b338 FlsSetValue 16511->16513 16514 7ff6d3b5b366 16512->16514 16515 7ff6d3b5b354 FlsSetValue 16512->16515 16516 7ff6d3b5b341 16513->16516 16517 7ff6d3b5aef4 _get_daylight 5 API calls 16514->16517 16515->16516 16518 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 16516->16518 16519 7ff6d3b5b36e 16517->16519 16518->16509 16520 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 16519->16520 16520->16507 16533 7ff6d3b602d8 EnterCriticalSection 16521->16533 16536 7ff6d3b5a64e __GetCurrentState memcpy_s 16535->16536 16537 7ff6d3b5a676 RtlCaptureContext RtlLookupFunctionEntry 16536->16537 16538 7ff6d3b5a6e6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16537->16538 16539 7ff6d3b5a6b0 RtlVirtualUnwind 16537->16539 16540 7ff6d3b5a738 __GetCurrentState 16538->16540 16539->16538 16541 7ff6d3b4c550 _log10_special 8 API calls 16540->16541 16542 7ff6d3b5a757 GetCurrentProcess TerminateProcess 16541->16542 16545 7ff6d3b4c87a 16544->16545 16545->16115 16545->16545 16547 7ff6d3b492bf FindClose 16546->16547 16548 7ff6d3b492d2 16546->16548 16547->16548 16549 7ff6d3b4c550 _log10_special 8 API calls 16548->16549 16550 7ff6d3b4371a 16549->16550 16550->16122 16550->16123 16552 7ff6d3b4c850 16551->16552 16553 7ff6d3b42c70 GetCurrentProcessId 16552->16553 16582 7ff6d3b426b0 16553->16582 16555 7ff6d3b42cb9 16586 7ff6d3b54bd8 16555->16586 16558 7ff6d3b426b0 48 API calls 16559 7ff6d3b42d34 FormatMessageW 16558->16559 16561 7ff6d3b42d6d 16559->16561 16562 7ff6d3b42d7f MessageBoxW 16559->16562 16563 7ff6d3b426b0 48 API calls 16561->16563 16564 7ff6d3b4c550 _log10_special 8 API calls 16562->16564 16563->16562 16565 7ff6d3b42daf 16564->16565 16565->16121 16567 7ff6d3b43730 16566->16567 16568 7ff6d3b49340 GetFinalPathNameByHandleW CloseHandle 16566->16568 16567->16130 16567->16131 16568->16567 16570 7ff6d3b42834 16569->16570 16571 7ff6d3b426b0 48 API calls 16570->16571 16572 7ff6d3b42887 16571->16572 16573 7ff6d3b54bd8 48 API calls 16572->16573 16574 7ff6d3b428d0 MessageBoxW 16573->16574 16575 7ff6d3b4c550 _log10_special 8 API calls 16574->16575 16576 7ff6d3b42900 16575->16576 16576->16121 16578 7ff6d3b4946a WideCharToMultiByte 16577->16578 16579 7ff6d3b49495 16577->16579 16578->16579 16581 7ff6d3b494ab __std_exception_destroy 16578->16581 16580 7ff6d3b494b2 WideCharToMultiByte 16579->16580 16579->16581 16580->16581 16581->16127 16583 7ff6d3b426d5 16582->16583 16584 7ff6d3b54bd8 48 API calls 16583->16584 16585 7ff6d3b426f8 16584->16585 16585->16555 16590 7ff6d3b54c32 16586->16590 16587 7ff6d3b54c57 16588 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16587->16588 16593 7ff6d3b54c81 16588->16593 16589 7ff6d3b54c93 16604 7ff6d3b52f90 16589->16604 16590->16587 16590->16589 16592 7ff6d3b54d74 16595 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16592->16595 16594 7ff6d3b4c550 _log10_special 8 API calls 16593->16594 16596 7ff6d3b42d04 16594->16596 16595->16593 16596->16558 16598 7ff6d3b54d9a 16598->16592 16600 7ff6d3b54da4 16598->16600 16599 7ff6d3b54d49 16601 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16599->16601 16603 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16600->16603 16601->16593 16602 7ff6d3b54d40 16602->16592 16602->16599 16603->16593 16605 7ff6d3b52fce 16604->16605 16610 7ff6d3b52fbe 16604->16610 16606 7ff6d3b52fd7 16605->16606 16611 7ff6d3b53005 16605->16611 16608 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16606->16608 16607 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16609 7ff6d3b52ffd 16607->16609 16608->16609 16609->16592 16609->16598 16609->16599 16609->16602 16610->16607 16611->16609 16611->16610 16615 7ff6d3b539a4 16611->16615 16648 7ff6d3b533f0 16611->16648 16685 7ff6d3b52b80 16611->16685 16616 7ff6d3b539e6 16615->16616 16617 7ff6d3b53a57 16615->16617 16620 7ff6d3b539ec 16616->16620 16621 7ff6d3b53a81 16616->16621 16618 7ff6d3b53a5c 16617->16618 16619 7ff6d3b53ab0 16617->16619 16624 7ff6d3b53a5e 16618->16624 16625 7ff6d3b53a91 16618->16625 16626 7ff6d3b53ac7 16619->16626 16628 7ff6d3b53aba 16619->16628 16633 7ff6d3b53abf 16619->16633 16622 7ff6d3b53a20 16620->16622 16623 7ff6d3b539f1 16620->16623 16708 7ff6d3b51d54 16621->16708 16629 7ff6d3b539f7 16622->16629 16622->16633 16623->16626 16623->16629 16627 7ff6d3b53a00 16624->16627 16637 7ff6d3b53a6d 16624->16637 16715 7ff6d3b51944 16625->16715 16722 7ff6d3b546ac 16626->16722 16646 7ff6d3b53af0 16627->16646 16688 7ff6d3b54158 16627->16688 16628->16621 16628->16633 16629->16627 16636 7ff6d3b53a32 16629->16636 16644 7ff6d3b53a1b 16629->16644 16633->16646 16726 7ff6d3b52164 16633->16726 16636->16646 16698 7ff6d3b54494 16636->16698 16637->16621 16638 7ff6d3b53a72 16637->16638 16638->16646 16704 7ff6d3b54558 16638->16704 16640 7ff6d3b4c550 _log10_special 8 API calls 16641 7ff6d3b53dea 16640->16641 16641->16611 16644->16646 16647 7ff6d3b53cdc 16644->16647 16733 7ff6d3b547c0 16644->16733 16646->16640 16647->16646 16739 7ff6d3b5ea08 16647->16739 16649 7ff6d3b53414 16648->16649 16650 7ff6d3b533fe 16648->16650 16651 7ff6d3b53454 16649->16651 16652 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16649->16652 16650->16651 16653 7ff6d3b539e6 16650->16653 16654 7ff6d3b53a57 16650->16654 16651->16611 16652->16651 16657 7ff6d3b539ec 16653->16657 16658 7ff6d3b53a81 16653->16658 16655 7ff6d3b53a5c 16654->16655 16656 7ff6d3b53ab0 16654->16656 16661 7ff6d3b53a5e 16655->16661 16662 7ff6d3b53a91 16655->16662 16663 7ff6d3b53abf 16656->16663 16664 7ff6d3b53ac7 16656->16664 16665 7ff6d3b53aba 16656->16665 16659 7ff6d3b53a20 16657->16659 16660 7ff6d3b539f1 16657->16660 16666 7ff6d3b51d54 38 API calls 16658->16666 16659->16663 16669 7ff6d3b539f7 16659->16669 16660->16664 16660->16669 16672 7ff6d3b53a6d 16661->16672 16674 7ff6d3b53a00 16661->16674 16667 7ff6d3b51944 38 API calls 16662->16667 16671 7ff6d3b52164 38 API calls 16663->16671 16683 7ff6d3b53af0 16663->16683 16670 7ff6d3b546ac 45 API calls 16664->16670 16665->16658 16665->16663 16680 7ff6d3b53a1b 16666->16680 16667->16680 16668 7ff6d3b54158 47 API calls 16668->16680 16673 7ff6d3b53a32 16669->16673 16669->16674 16669->16680 16670->16680 16671->16680 16672->16658 16675 7ff6d3b53a72 16672->16675 16676 7ff6d3b54494 46 API calls 16673->16676 16673->16683 16674->16668 16674->16683 16678 7ff6d3b54558 37 API calls 16675->16678 16675->16683 16676->16680 16677 7ff6d3b4c550 _log10_special 8 API calls 16679 7ff6d3b53dea 16677->16679 16678->16680 16679->16611 16681 7ff6d3b547c0 45 API calls 16680->16681 16680->16683 16684 7ff6d3b53cdc 16680->16684 16681->16684 16682 7ff6d3b5ea08 46 API calls 16682->16684 16683->16677 16684->16682 16684->16683 16965 7ff6d3b50fc8 16685->16965 16689 7ff6d3b5417e 16688->16689 16751 7ff6d3b50b80 16689->16751 16694 7ff6d3b542c3 16696 7ff6d3b547c0 45 API calls 16694->16696 16697 7ff6d3b54351 16694->16697 16695 7ff6d3b547c0 45 API calls 16695->16694 16696->16697 16697->16644 16699 7ff6d3b544c9 16698->16699 16700 7ff6d3b544e7 16699->16700 16701 7ff6d3b547c0 45 API calls 16699->16701 16703 7ff6d3b5450e 16699->16703 16702 7ff6d3b5ea08 46 API calls 16700->16702 16701->16700 16702->16703 16703->16644 16706 7ff6d3b54579 16704->16706 16705 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16707 7ff6d3b545aa 16705->16707 16706->16705 16706->16707 16707->16644 16709 7ff6d3b51d87 16708->16709 16710 7ff6d3b51db6 16709->16710 16712 7ff6d3b51e73 16709->16712 16714 7ff6d3b51df3 16710->16714 16897 7ff6d3b50c28 16710->16897 16713 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16712->16713 16713->16714 16714->16644 16716 7ff6d3b51977 16715->16716 16717 7ff6d3b519a6 16716->16717 16719 7ff6d3b51a63 16716->16719 16718 7ff6d3b50c28 12 API calls 16717->16718 16721 7ff6d3b519e3 16717->16721 16718->16721 16720 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16719->16720 16720->16721 16721->16644 16723 7ff6d3b546ef 16722->16723 16725 7ff6d3b546f3 __crtLCMapStringW 16723->16725 16905 7ff6d3b54748 16723->16905 16725->16644 16727 7ff6d3b52197 16726->16727 16728 7ff6d3b521c6 16727->16728 16730 7ff6d3b52283 16727->16730 16729 7ff6d3b50c28 12 API calls 16728->16729 16732 7ff6d3b52203 16728->16732 16729->16732 16731 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16730->16731 16731->16732 16732->16644 16734 7ff6d3b547d7 16733->16734 16909 7ff6d3b5d9b8 16734->16909 16741 7ff6d3b5ea39 16739->16741 16748 7ff6d3b5ea47 16739->16748 16740 7ff6d3b5ea67 16743 7ff6d3b5ea78 16740->16743 16744 7ff6d3b5ea9f 16740->16744 16741->16740 16742 7ff6d3b547c0 45 API calls 16741->16742 16741->16748 16742->16740 16955 7ff6d3b600a0 16743->16955 16746 7ff6d3b5eb2a 16744->16746 16747 7ff6d3b5eac9 16744->16747 16744->16748 16749 7ff6d3b5f8a0 _fread_nolock MultiByteToWideChar 16746->16749 16747->16748 16958 7ff6d3b5f8a0 16747->16958 16748->16647 16749->16748 16752 7ff6d3b50bb7 16751->16752 16753 7ff6d3b50ba6 16751->16753 16752->16753 16781 7ff6d3b5d5fc 16752->16781 16759 7ff6d3b5e570 16753->16759 16756 7ff6d3b50bf8 16758 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16756->16758 16757 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16757->16756 16758->16753 16760 7ff6d3b5e58d 16759->16760 16761 7ff6d3b5e5c0 16759->16761 16762 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16760->16762 16761->16760 16763 7ff6d3b5e5f2 16761->16763 16774 7ff6d3b542a1 16762->16774 16765 7ff6d3b5e705 16763->16765 16776 7ff6d3b5e63a 16763->16776 16764 7ff6d3b5e7f7 16821 7ff6d3b5da5c 16764->16821 16765->16764 16767 7ff6d3b5e7bd 16765->16767 16769 7ff6d3b5e78c 16765->16769 16770 7ff6d3b5e74f 16765->16770 16772 7ff6d3b5e745 16765->16772 16814 7ff6d3b5ddf4 16767->16814 16807 7ff6d3b5e0d4 16769->16807 16797 7ff6d3b5e304 16770->16797 16772->16767 16775 7ff6d3b5e74a 16772->16775 16774->16694 16774->16695 16775->16769 16775->16770 16776->16774 16788 7ff6d3b5a4a4 16776->16788 16779 7ff6d3b5a900 _isindst 17 API calls 16780 7ff6d3b5e854 16779->16780 16782 7ff6d3b5d60b _get_daylight 16781->16782 16783 7ff6d3b5d647 16781->16783 16782->16783 16785 7ff6d3b5d62e HeapAlloc 16782->16785 16787 7ff6d3b63590 _get_daylight 2 API calls 16782->16787 16784 7ff6d3b54f08 _get_daylight 11 API calls 16783->16784 16786 7ff6d3b50be4 16784->16786 16785->16782 16785->16786 16786->16756 16786->16757 16787->16782 16790 7ff6d3b5a4b1 16788->16790 16792 7ff6d3b5a4bb 16788->16792 16789 7ff6d3b54f08 _get_daylight 11 API calls 16791 7ff6d3b5a4c2 16789->16791 16790->16792 16795 7ff6d3b5a4d6 16790->16795 16830 7ff6d3b5a8e0 16791->16830 16792->16789 16794 7ff6d3b5a4ce 16794->16774 16794->16779 16795->16794 16796 7ff6d3b54f08 _get_daylight 11 API calls 16795->16796 16796->16791 16833 7ff6d3b640ac 16797->16833 16801 7ff6d3b5e3ac 16802 7ff6d3b5e401 16801->16802 16803 7ff6d3b5e3cc 16801->16803 16806 7ff6d3b5e3b0 16801->16806 16886 7ff6d3b5def0 16802->16886 16882 7ff6d3b5e1ac 16803->16882 16806->16774 16808 7ff6d3b640ac 38 API calls 16807->16808 16809 7ff6d3b5e11e 16808->16809 16810 7ff6d3b63af4 37 API calls 16809->16810 16811 7ff6d3b5e16e 16810->16811 16812 7ff6d3b5e172 16811->16812 16813 7ff6d3b5e1ac 45 API calls 16811->16813 16812->16774 16813->16812 16815 7ff6d3b640ac 38 API calls 16814->16815 16816 7ff6d3b5de3f 16815->16816 16817 7ff6d3b63af4 37 API calls 16816->16817 16818 7ff6d3b5de97 16817->16818 16819 7ff6d3b5de9b 16818->16819 16820 7ff6d3b5def0 45 API calls 16818->16820 16819->16774 16820->16819 16822 7ff6d3b5dad4 16821->16822 16823 7ff6d3b5daa1 16821->16823 16825 7ff6d3b5daec 16822->16825 16827 7ff6d3b5db6d 16822->16827 16824 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16823->16824 16829 7ff6d3b5dacd memcpy_s 16824->16829 16826 7ff6d3b5ddf4 46 API calls 16825->16826 16826->16829 16828 7ff6d3b547c0 45 API calls 16827->16828 16827->16829 16828->16829 16829->16774 16831 7ff6d3b5a778 _invalid_parameter_noinfo 37 API calls 16830->16831 16832 7ff6d3b5a8f9 16831->16832 16832->16794 16834 7ff6d3b640ff fegetenv 16833->16834 16835 7ff6d3b67e2c 37 API calls 16834->16835 16838 7ff6d3b64152 16835->16838 16836 7ff6d3b6417f 16841 7ff6d3b5a4a4 __std_exception_copy 37 API calls 16836->16841 16837 7ff6d3b64242 16839 7ff6d3b67e2c 37 API calls 16837->16839 16838->16837 16842 7ff6d3b6421c 16838->16842 16843 7ff6d3b6416d 16838->16843 16840 7ff6d3b6426c 16839->16840 16844 7ff6d3b67e2c 37 API calls 16840->16844 16845 7ff6d3b641fd 16841->16845 16848 7ff6d3b5a4a4 __std_exception_copy 37 API calls 16842->16848 16843->16836 16843->16837 16846 7ff6d3b6427d 16844->16846 16847 7ff6d3b65324 16845->16847 16851 7ff6d3b64205 16845->16851 16849 7ff6d3b68020 20 API calls 16846->16849 16850 7ff6d3b5a900 _isindst 17 API calls 16847->16850 16848->16845 16860 7ff6d3b642e6 memcpy_s 16849->16860 16852 7ff6d3b65339 16850->16852 16853 7ff6d3b4c550 _log10_special 8 API calls 16851->16853 16854 7ff6d3b5e351 16853->16854 16878 7ff6d3b63af4 16854->16878 16855 7ff6d3b6468f memcpy_s 16856 7ff6d3b649cf 16857 7ff6d3b63c10 37 API calls 16856->16857 16864 7ff6d3b650e7 16857->16864 16858 7ff6d3b6497b 16858->16856 16861 7ff6d3b6533c memcpy_s 37 API calls 16858->16861 16859 7ff6d3b64327 memcpy_s 16872 7ff6d3b64783 memcpy_s 16859->16872 16873 7ff6d3b64c6b memcpy_s 16859->16873 16860->16855 16860->16859 16862 7ff6d3b54f08 _get_daylight 11 API calls 16860->16862 16861->16856 16863 7ff6d3b64760 16862->16863 16865 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 16863->16865 16867 7ff6d3b6533c memcpy_s 37 API calls 16864->16867 16876 7ff6d3b65142 16864->16876 16865->16859 16866 7ff6d3b652c8 16869 7ff6d3b67e2c 37 API calls 16866->16869 16867->16876 16868 7ff6d3b54f08 11 API calls _get_daylight 16868->16873 16869->16851 16870 7ff6d3b54f08 11 API calls _get_daylight 16870->16872 16871 7ff6d3b63c10 37 API calls 16871->16876 16872->16858 16872->16870 16874 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 16872->16874 16873->16856 16873->16858 16873->16868 16877 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 16873->16877 16874->16872 16875 7ff6d3b6533c memcpy_s 37 API calls 16875->16876 16876->16866 16876->16871 16876->16875 16877->16873 16879 7ff6d3b63b13 16878->16879 16880 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16879->16880 16881 7ff6d3b63b3e memcpy_s 16879->16881 16880->16881 16881->16801 16883 7ff6d3b5e1d8 memcpy_s 16882->16883 16884 7ff6d3b547c0 45 API calls 16883->16884 16885 7ff6d3b5e292 memcpy_s 16883->16885 16884->16885 16885->16806 16887 7ff6d3b5df2b 16886->16887 16891 7ff6d3b5df78 memcpy_s 16886->16891 16888 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16887->16888 16889 7ff6d3b5df57 16888->16889 16889->16806 16890 7ff6d3b5dfe3 16892 7ff6d3b5a4a4 __std_exception_copy 37 API calls 16890->16892 16891->16890 16893 7ff6d3b547c0 45 API calls 16891->16893 16896 7ff6d3b5e025 memcpy_s 16892->16896 16893->16890 16894 7ff6d3b5a900 _isindst 17 API calls 16895 7ff6d3b5e0d0 16894->16895 16896->16894 16898 7ff6d3b50c5f 16897->16898 16904 7ff6d3b50c4e 16897->16904 16899 7ff6d3b5d5fc _fread_nolock 12 API calls 16898->16899 16898->16904 16900 7ff6d3b50c90 16899->16900 16901 7ff6d3b50ca4 16900->16901 16902 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16900->16902 16903 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16901->16903 16902->16901 16903->16904 16904->16714 16906 7ff6d3b54766 16905->16906 16907 7ff6d3b5476e 16905->16907 16908 7ff6d3b547c0 45 API calls 16906->16908 16907->16725 16908->16907 16910 7ff6d3b547ff 16909->16910 16911 7ff6d3b5d9d1 16909->16911 16913 7ff6d3b5da24 16910->16913 16911->16910 16917 7ff6d3b63304 16911->16917 16914 7ff6d3b5da3d 16913->16914 16915 7ff6d3b5480f 16913->16915 16914->16915 16952 7ff6d3b62650 16914->16952 16915->16647 16929 7ff6d3b5b150 GetLastError 16917->16929 16920 7ff6d3b6335e 16920->16910 16930 7ff6d3b5b174 FlsGetValue 16929->16930 16931 7ff6d3b5b191 FlsSetValue 16929->16931 16932 7ff6d3b5b18b 16930->16932 16949 7ff6d3b5b181 16930->16949 16933 7ff6d3b5b1a3 16931->16933 16931->16949 16932->16931 16935 7ff6d3b5eb98 _get_daylight 11 API calls 16933->16935 16934 7ff6d3b5b1fd SetLastError 16936 7ff6d3b5b20a 16934->16936 16937 7ff6d3b5b21d 16934->16937 16938 7ff6d3b5b1b2 16935->16938 16936->16920 16951 7ff6d3b602d8 EnterCriticalSection 16936->16951 16939 7ff6d3b5a504 __GetCurrentState 38 API calls 16937->16939 16940 7ff6d3b5b1d0 FlsSetValue 16938->16940 16941 7ff6d3b5b1c0 FlsSetValue 16938->16941 16942 7ff6d3b5b222 16939->16942 16944 7ff6d3b5b1dc FlsSetValue 16940->16944 16945 7ff6d3b5b1ee 16940->16945 16943 7ff6d3b5b1c9 16941->16943 16947 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16943->16947 16944->16943 16946 7ff6d3b5aef4 _get_daylight 11 API calls 16945->16946 16948 7ff6d3b5b1f6 16946->16948 16947->16949 16950 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16948->16950 16949->16934 16950->16934 16953 7ff6d3b5b150 __GetCurrentState 45 API calls 16952->16953 16954 7ff6d3b62659 16953->16954 16961 7ff6d3b66d88 16955->16961 16959 7ff6d3b5f8a9 MultiByteToWideChar 16958->16959 16964 7ff6d3b66dec 16961->16964 16962 7ff6d3b4c550 _log10_special 8 API calls 16963 7ff6d3b600bd 16962->16963 16963->16748 16964->16962 16966 7ff6d3b50ffd 16965->16966 16967 7ff6d3b5100f 16965->16967 16968 7ff6d3b54f08 _get_daylight 11 API calls 16966->16968 16969 7ff6d3b51059 16967->16969 16971 7ff6d3b5101d 16967->16971 16970 7ff6d3b51002 16968->16970 16974 7ff6d3b513d5 16969->16974 16976 7ff6d3b54f08 _get_daylight 11 API calls 16969->16976 16972 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 16970->16972 16973 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 16971->16973 16979 7ff6d3b5100d 16972->16979 16973->16979 16975 7ff6d3b54f08 _get_daylight 11 API calls 16974->16975 16974->16979 16977 7ff6d3b51669 16975->16977 16978 7ff6d3b513ca 16976->16978 16980 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 16977->16980 16981 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 16978->16981 16979->16611 16980->16979 16981->16974 16983 7ff6d3b50704 16982->16983 17010 7ff6d3b50464 16983->17010 16985 7ff6d3b5071d 16985->16145 17022 7ff6d3b503bc 16986->17022 16990 7ff6d3b4c850 16989->16990 16991 7ff6d3b42930 GetCurrentProcessId 16990->16991 16992 7ff6d3b41c80 49 API calls 16991->16992 16993 7ff6d3b42979 16992->16993 17036 7ff6d3b54984 16993->17036 16998 7ff6d3b41c80 49 API calls 16999 7ff6d3b429ff 16998->16999 17066 7ff6d3b42620 16999->17066 17002 7ff6d3b4c550 _log10_special 8 API calls 17003 7ff6d3b42a31 17002->17003 17003->16184 17005 7ff6d3b41b89 17004->17005 17006 7ff6d3b50119 17004->17006 17005->16183 17005->16184 17007 7ff6d3b54f08 _get_daylight 11 API calls 17006->17007 17008 7ff6d3b5011e 17007->17008 17009 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 17008->17009 17009->17005 17011 7ff6d3b504ce 17010->17011 17012 7ff6d3b5048e 17010->17012 17011->17012 17014 7ff6d3b504da 17011->17014 17013 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17012->17013 17015 7ff6d3b504b5 17013->17015 17021 7ff6d3b5546c EnterCriticalSection 17014->17021 17015->16985 17023 7ff6d3b503e6 17022->17023 17024 7ff6d3b41a20 17022->17024 17023->17024 17025 7ff6d3b50432 17023->17025 17026 7ff6d3b503f5 memcpy_s 17023->17026 17024->16152 17024->16153 17035 7ff6d3b5546c EnterCriticalSection 17025->17035 17028 7ff6d3b54f08 _get_daylight 11 API calls 17026->17028 17030 7ff6d3b5040a 17028->17030 17032 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 17030->17032 17032->17024 17039 7ff6d3b549de 17036->17039 17037 7ff6d3b54a03 17038 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17037->17038 17053 7ff6d3b54a2d 17038->17053 17039->17037 17040 7ff6d3b54a3f 17039->17040 17075 7ff6d3b52c10 17040->17075 17042 7ff6d3b54b1c 17045 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17042->17045 17044 7ff6d3b4c550 _log10_special 8 API calls 17046 7ff6d3b429c3 17044->17046 17045->17053 17054 7ff6d3b55160 17046->17054 17047 7ff6d3b54af1 17049 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17047->17049 17048 7ff6d3b54b40 17048->17042 17051 7ff6d3b54b4a 17048->17051 17049->17053 17050 7ff6d3b54ae8 17050->17042 17050->17047 17052 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17051->17052 17052->17053 17053->17044 17055 7ff6d3b5b2c8 _get_daylight 11 API calls 17054->17055 17056 7ff6d3b55177 17055->17056 17057 7ff6d3b5eb98 _get_daylight 11 API calls 17056->17057 17059 7ff6d3b551b7 17056->17059 17063 7ff6d3b429e5 17056->17063 17058 7ff6d3b551ac 17057->17058 17060 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17058->17060 17059->17063 17213 7ff6d3b5ec20 17059->17213 17060->17059 17063->16998 17064 7ff6d3b5a900 _isindst 17 API calls 17065 7ff6d3b551fc 17064->17065 17067 7ff6d3b4262f 17066->17067 17068 7ff6d3b49390 2 API calls 17067->17068 17069 7ff6d3b42660 17068->17069 17070 7ff6d3b4266f MessageBoxW 17069->17070 17071 7ff6d3b42683 MessageBoxA 17069->17071 17072 7ff6d3b42690 17070->17072 17071->17072 17073 7ff6d3b4c550 _log10_special 8 API calls 17072->17073 17074 7ff6d3b426a0 17073->17074 17074->17002 17076 7ff6d3b52c4e 17075->17076 17081 7ff6d3b52c3e 17075->17081 17077 7ff6d3b52c57 17076->17077 17085 7ff6d3b52c85 17076->17085 17079 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17077->17079 17078 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17080 7ff6d3b52c7d 17078->17080 17079->17080 17080->17042 17080->17047 17080->17048 17080->17050 17081->17078 17082 7ff6d3b547c0 45 API calls 17082->17085 17084 7ff6d3b52f34 17087 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17084->17087 17085->17080 17085->17081 17085->17082 17085->17084 17089 7ff6d3b535a0 17085->17089 17115 7ff6d3b53268 17085->17115 17145 7ff6d3b52af0 17085->17145 17087->17081 17090 7ff6d3b535e2 17089->17090 17091 7ff6d3b53655 17089->17091 17094 7ff6d3b535e8 17090->17094 17095 7ff6d3b5367f 17090->17095 17092 7ff6d3b5365a 17091->17092 17093 7ff6d3b536af 17091->17093 17096 7ff6d3b5365c 17092->17096 17097 7ff6d3b5368f 17092->17097 17093->17095 17105 7ff6d3b536be 17093->17105 17113 7ff6d3b53618 17093->17113 17102 7ff6d3b535ed 17094->17102 17094->17105 17162 7ff6d3b51b50 17095->17162 17098 7ff6d3b535fd 17096->17098 17104 7ff6d3b5366b 17096->17104 17169 7ff6d3b51740 17097->17169 17114 7ff6d3b536ed 17098->17114 17148 7ff6d3b53f04 17098->17148 17102->17098 17103 7ff6d3b53630 17102->17103 17102->17113 17103->17114 17158 7ff6d3b543c0 17103->17158 17104->17095 17107 7ff6d3b53670 17104->17107 17105->17114 17176 7ff6d3b51f60 17105->17176 17110 7ff6d3b54558 37 API calls 17107->17110 17107->17114 17109 7ff6d3b4c550 _log10_special 8 API calls 17111 7ff6d3b53983 17109->17111 17110->17113 17111->17085 17113->17114 17183 7ff6d3b5e858 17113->17183 17114->17109 17116 7ff6d3b53273 17115->17116 17117 7ff6d3b53289 17115->17117 17118 7ff6d3b532c7 17116->17118 17120 7ff6d3b535e2 17116->17120 17121 7ff6d3b53655 17116->17121 17117->17118 17119 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17117->17119 17118->17085 17119->17118 17124 7ff6d3b535e8 17120->17124 17125 7ff6d3b5367f 17120->17125 17122 7ff6d3b5365a 17121->17122 17123 7ff6d3b536af 17121->17123 17126 7ff6d3b5365c 17122->17126 17127 7ff6d3b5368f 17122->17127 17123->17125 17134 7ff6d3b536be 17123->17134 17143 7ff6d3b53618 17123->17143 17132 7ff6d3b535ed 17124->17132 17124->17134 17129 7ff6d3b51b50 38 API calls 17125->17129 17128 7ff6d3b535fd 17126->17128 17136 7ff6d3b5366b 17126->17136 17130 7ff6d3b51740 38 API calls 17127->17130 17131 7ff6d3b53f04 47 API calls 17128->17131 17144 7ff6d3b536ed 17128->17144 17129->17143 17130->17143 17131->17143 17132->17128 17133 7ff6d3b53630 17132->17133 17132->17143 17137 7ff6d3b543c0 47 API calls 17133->17137 17133->17144 17135 7ff6d3b51f60 38 API calls 17134->17135 17134->17144 17135->17143 17136->17125 17138 7ff6d3b53670 17136->17138 17137->17143 17140 7ff6d3b54558 37 API calls 17138->17140 17138->17144 17139 7ff6d3b4c550 _log10_special 8 API calls 17141 7ff6d3b53983 17139->17141 17140->17143 17141->17085 17142 7ff6d3b5e858 47 API calls 17142->17143 17143->17142 17143->17144 17144->17139 17196 7ff6d3b50d14 17145->17196 17149 7ff6d3b53f26 17148->17149 17150 7ff6d3b50b80 12 API calls 17149->17150 17151 7ff6d3b53f6e 17150->17151 17152 7ff6d3b5e570 46 API calls 17151->17152 17153 7ff6d3b54041 17152->17153 17154 7ff6d3b54063 17153->17154 17155 7ff6d3b547c0 45 API calls 17153->17155 17156 7ff6d3b547c0 45 API calls 17154->17156 17157 7ff6d3b540ec 17154->17157 17155->17154 17156->17157 17157->17113 17159 7ff6d3b543d8 17158->17159 17161 7ff6d3b54440 17158->17161 17160 7ff6d3b5e858 47 API calls 17159->17160 17159->17161 17160->17161 17161->17113 17163 7ff6d3b51b83 17162->17163 17164 7ff6d3b51bb2 17163->17164 17166 7ff6d3b51c6f 17163->17166 17165 7ff6d3b50b80 12 API calls 17164->17165 17168 7ff6d3b51bef 17164->17168 17165->17168 17167 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17166->17167 17167->17168 17168->17113 17170 7ff6d3b51773 17169->17170 17171 7ff6d3b517a2 17170->17171 17173 7ff6d3b5185f 17170->17173 17172 7ff6d3b50b80 12 API calls 17171->17172 17175 7ff6d3b517df 17171->17175 17172->17175 17174 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17173->17174 17174->17175 17175->17113 17178 7ff6d3b51f93 17176->17178 17177 7ff6d3b51fc2 17179 7ff6d3b50b80 12 API calls 17177->17179 17182 7ff6d3b51fff 17177->17182 17178->17177 17180 7ff6d3b5207f 17178->17180 17179->17182 17181 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17180->17181 17181->17182 17182->17113 17185 7ff6d3b5e880 17183->17185 17184 7ff6d3b5e8c5 17189 7ff6d3b5e885 memcpy_s 17184->17189 17192 7ff6d3b5e8ae memcpy_s 17184->17192 17193 7ff6d3b607e8 17184->17193 17185->17184 17186 7ff6d3b547c0 45 API calls 17185->17186 17185->17189 17185->17192 17186->17184 17187 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17187->17189 17189->17113 17192->17187 17192->17189 17195 7ff6d3b6080c WideCharToMultiByte 17193->17195 17197 7ff6d3b50d53 17196->17197 17198 7ff6d3b50d41 17196->17198 17201 7ff6d3b50d60 17197->17201 17204 7ff6d3b50d9d 17197->17204 17199 7ff6d3b54f08 _get_daylight 11 API calls 17198->17199 17200 7ff6d3b50d46 17199->17200 17202 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 17200->17202 17203 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 17201->17203 17208 7ff6d3b50d51 17202->17208 17203->17208 17205 7ff6d3b50e46 17204->17205 17206 7ff6d3b54f08 _get_daylight 11 API calls 17204->17206 17207 7ff6d3b54f08 _get_daylight 11 API calls 17205->17207 17205->17208 17209 7ff6d3b50e3b 17206->17209 17210 7ff6d3b50ef0 17207->17210 17208->17085 17211 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 17209->17211 17212 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 17210->17212 17211->17205 17212->17208 17217 7ff6d3b5ec3d 17213->17217 17214 7ff6d3b5ec42 17215 7ff6d3b551dd 17214->17215 17216 7ff6d3b54f08 _get_daylight 11 API calls 17214->17216 17215->17063 17215->17064 17218 7ff6d3b5ec4c 17216->17218 17217->17214 17217->17215 17220 7ff6d3b5ec8c 17217->17220 17219 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 17218->17219 17219->17215 17220->17215 17221 7ff6d3b54f08 _get_daylight 11 API calls 17220->17221 17221->17218 17223 7ff6d3b48633 __std_exception_destroy 17222->17223 17224 7ff6d3b485b1 GetTokenInformation 17222->17224 17226 7ff6d3b4864c 17223->17226 17227 7ff6d3b48646 CloseHandle 17223->17227 17225 7ff6d3b485d2 GetLastError 17224->17225 17228 7ff6d3b485dd 17224->17228 17225->17223 17225->17228 17226->16202 17227->17226 17228->17223 17229 7ff6d3b485f9 GetTokenInformation 17228->17229 17229->17223 17230 7ff6d3b4861c 17229->17230 17230->17223 17231 7ff6d3b48626 ConvertSidToStringSidW 17230->17231 17231->17223 17233 7ff6d3b4c850 17232->17233 17234 7ff6d3b42b74 GetCurrentProcessId 17233->17234 17235 7ff6d3b426b0 48 API calls 17234->17235 17236 7ff6d3b42bc7 17235->17236 17237 7ff6d3b54bd8 48 API calls 17236->17237 17238 7ff6d3b42c10 MessageBoxW 17237->17238 17239 7ff6d3b4c550 _log10_special 8 API calls 17238->17239 17240 7ff6d3b42c40 17239->17240 17240->16212 17242 7ff6d3b425e5 17241->17242 17243 7ff6d3b54bd8 48 API calls 17242->17243 17244 7ff6d3b42604 17243->17244 17244->16228 17290 7ff6d3b58794 17245->17290 17249 7ff6d3b481dc 17248->17249 17250 7ff6d3b49390 2 API calls 17249->17250 17251 7ff6d3b481fb 17250->17251 17252 7ff6d3b48216 ExpandEnvironmentStringsW 17251->17252 17253 7ff6d3b48203 17251->17253 17255 7ff6d3b4823c __std_exception_destroy 17252->17255 17254 7ff6d3b42810 49 API calls 17253->17254 17279 7ff6d3b4820f __std_exception_destroy 17254->17279 17256 7ff6d3b48253 17255->17256 17257 7ff6d3b48240 17255->17257 17261 7ff6d3b482bf 17256->17261 17262 7ff6d3b48261 GetDriveTypeW 17256->17262 17259 7ff6d3b42810 49 API calls 17257->17259 17258 7ff6d3b4c550 _log10_special 8 API calls 17259->17279 17279->17258 17331 7ff6d3b61558 17290->17331 17390 7ff6d3b612d0 17331->17390 17411 7ff6d3b602d8 EnterCriticalSection 17390->17411 17538 7ff6d3b4456a 17537->17538 17539 7ff6d3b49390 2 API calls 17538->17539 17540 7ff6d3b4458f 17539->17540 17541 7ff6d3b4c550 _log10_special 8 API calls 17540->17541 17542 7ff6d3b445b7 17541->17542 17542->16269 17544 7ff6d3b47e2e 17543->17544 17545 7ff6d3b41c80 49 API calls 17544->17545 17548 7ff6d3b47f52 17544->17548 17551 7ff6d3b47eb5 17545->17551 17546 7ff6d3b4c550 _log10_special 8 API calls 17547 7ff6d3b47f83 17546->17547 17547->16269 17548->17546 17549 7ff6d3b41c80 49 API calls 17549->17551 17550 7ff6d3b44560 10 API calls 17550->17551 17551->17548 17551->17549 17551->17550 17552 7ff6d3b49390 2 API calls 17551->17552 17553 7ff6d3b47f23 CreateDirectoryW 17552->17553 17553->17548 17553->17551 17555 7ff6d3b41637 17554->17555 17556 7ff6d3b41613 17554->17556 17557 7ff6d3b445c0 108 API calls 17555->17557 17675 7ff6d3b41050 17556->17675 17559 7ff6d3b4164b 17557->17559 17561 7ff6d3b41653 17559->17561 17562 7ff6d3b41682 17559->17562 17560 7ff6d3b41618 17563 7ff6d3b4162e 17560->17563 17564 7ff6d3b42710 54 API calls 17560->17564 17565 7ff6d3b54f08 _get_daylight 11 API calls 17561->17565 17566 7ff6d3b445c0 108 API calls 17562->17566 17563->16269 17564->17563 17567 7ff6d3b41658 17565->17567 17568 7ff6d3b41696 17566->17568 17569 7ff6d3b42910 54 API calls 17567->17569 17570 7ff6d3b416b8 17568->17570 17571 7ff6d3b4169e 17568->17571 17573 7ff6d3b41671 17569->17573 17572 7ff6d3b506d4 73 API calls 17570->17572 17574 7ff6d3b42710 54 API calls 17571->17574 17575 7ff6d3b416cd 17572->17575 17573->16269 17576 7ff6d3b416ae 17574->17576 17577 7ff6d3b416f9 17575->17577 17578 7ff6d3b416d1 17575->17578 17582 7ff6d3b5004c 74 API calls 17576->17582 17604 7ff6d3b4718b 17602->17604 17605 7ff6d3b47144 17602->17605 17604->16269 17605->17604 17739 7ff6d3b55024 17605->17739 17607 7ff6d3b441a1 17606->17607 17608 7ff6d3b444e0 49 API calls 17607->17608 17609 7ff6d3b441db 17608->17609 17610 7ff6d3b444e0 49 API calls 17609->17610 17611 7ff6d3b441eb 17610->17611 17612 7ff6d3b4420d 17611->17612 17613 7ff6d3b4423c 17611->17613 17770 7ff6d3b44110 17612->17770 17615 7ff6d3b44110 51 API calls 17613->17615 17616 7ff6d3b4423a 17615->17616 17617 7ff6d3b44267 17616->17617 17618 7ff6d3b4429c 17616->17618 17777 7ff6d3b47cf0 17617->17777 17620 7ff6d3b44110 51 API calls 17618->17620 17622 7ff6d3b442c0 17620->17622 17651 7ff6d3b41c80 49 API calls 17650->17651 17652 7ff6d3b44474 17651->17652 17652->16269 17676 7ff6d3b445c0 108 API calls 17675->17676 17677 7ff6d3b4108c 17676->17677 17678 7ff6d3b410a9 17677->17678 17679 7ff6d3b41094 17677->17679 17680 7ff6d3b506d4 73 API calls 17678->17680 17681 7ff6d3b42710 54 API calls 17679->17681 17682 7ff6d3b410bf 17680->17682 17687 7ff6d3b410a4 __std_exception_destroy 17681->17687 17683 7ff6d3b410e6 17682->17683 17684 7ff6d3b410c3 17682->17684 17689 7ff6d3b410f7 17683->17689 17690 7ff6d3b41122 17683->17690 17685 7ff6d3b54f08 _get_daylight 11 API calls 17684->17685 17686 7ff6d3b410c8 17685->17686 17688 7ff6d3b42910 54 API calls 17686->17688 17687->17560 17692 7ff6d3b54f08 _get_daylight 11 API calls 17689->17692 17691 7ff6d3b41129 17690->17691 17700 7ff6d3b4113c 17690->17700 17693 7ff6d3b41210 92 API calls 17691->17693 17740 7ff6d3b5505e 17739->17740 17741 7ff6d3b55031 17739->17741 17743 7ff6d3b55081 17740->17743 17744 7ff6d3b5509d 17740->17744 17742 7ff6d3b54f08 _get_daylight 11 API calls 17741->17742 17749 7ff6d3b54fe8 17741->17749 17745 7ff6d3b5503b 17742->17745 17746 7ff6d3b54f08 _get_daylight 11 API calls 17743->17746 17754 7ff6d3b54f4c 17744->17754 17748 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 17745->17748 17750 7ff6d3b55086 17746->17750 17751 7ff6d3b55046 17748->17751 17749->17605 17752 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 17750->17752 17751->17605 17753 7ff6d3b55091 17752->17753 17753->17605 17755 7ff6d3b54f70 17754->17755 17761 7ff6d3b54f6b 17754->17761 17756 7ff6d3b5b150 __GetCurrentState 45 API calls 17755->17756 17755->17761 17757 7ff6d3b54f8b 17756->17757 17762 7ff6d3b5d984 17757->17762 17761->17753 17763 7ff6d3b5d999 17762->17763 17764 7ff6d3b54fae 17762->17764 17763->17764 17771 7ff6d3b44136 17770->17771 17772 7ff6d3b54984 49 API calls 17771->17772 17773 7ff6d3b4415c 17772->17773 17834 7ff6d3b55ec8 17833->17834 17835 7ff6d3b55eee 17834->17835 17837 7ff6d3b55f21 17834->17837 17836 7ff6d3b54f08 _get_daylight 11 API calls 17835->17836 17838 7ff6d3b55ef3 17836->17838 17839 7ff6d3b55f27 17837->17839 17840 7ff6d3b55f34 17837->17840 17841 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 17838->17841 17842 7ff6d3b54f08 _get_daylight 11 API calls 17839->17842 17852 7ff6d3b5ac28 17840->17852 17844 7ff6d3b44616 17841->17844 17842->17844 17844->16290 17865 7ff6d3b602d8 EnterCriticalSection 17852->17865 18225 7ff6d3b578f8 18224->18225 18228 7ff6d3b573d4 18225->18228 18227 7ff6d3b57911 18227->16300 18229 7ff6d3b5741e 18228->18229 18230 7ff6d3b573ef 18228->18230 18238 7ff6d3b5546c EnterCriticalSection 18229->18238 18232 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 18230->18232 18234 7ff6d3b5740f 18232->18234 18234->18227 18240 7ff6d3b4fe43 18239->18240 18242 7ff6d3b4fe71 18239->18242 18241 7ff6d3b5a814 _invalid_parameter_noinfo 37 API calls 18240->18241 18243 7ff6d3b4fe63 18241->18243 18242->18243 18249 7ff6d3b5546c EnterCriticalSection 18242->18249 18243->16304 18251 7ff6d3b4caf2 RtlLookupFunctionEntry 18250->18251 18252 7ff6d3b4cb08 RtlVirtualUnwind 18251->18252 18253 7ff6d3b4c90b 18251->18253 18252->18251 18252->18253 18254 7ff6d3b4c8a0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 18253->18254 18256 7ff6d3b445c0 108 API calls 18255->18256 18257 7ff6d3b41493 18256->18257 18258 7ff6d3b414bc 18257->18258 18259 7ff6d3b4149b 18257->18259 18261 7ff6d3b506d4 73 API calls 18258->18261 18260 7ff6d3b42710 54 API calls 18259->18260 18262 7ff6d3b414ab 18260->18262 18263 7ff6d3b414d1 18261->18263 18262->16346 18264 7ff6d3b414f8 18263->18264 18265 7ff6d3b414d5 18263->18265 18269 7ff6d3b41508 18264->18269 18270 7ff6d3b41532 18264->18270 18266 7ff6d3b54f08 _get_daylight 11 API calls 18265->18266 18362 7ff6d3b46375 18361->18362 18363 7ff6d3b41c80 49 API calls 18362->18363 18364 7ff6d3b463b1 18363->18364 18365 7ff6d3b463dd 18364->18365 18366 7ff6d3b463ba 18364->18366 18368 7ff6d3b44630 49 API calls 18365->18368 18367 7ff6d3b42710 54 API calls 18366->18367 18384 7ff6d3b463d3 18367->18384 18369 7ff6d3b463f5 18368->18369 18370 7ff6d3b46413 18369->18370 18372 7ff6d3b42710 54 API calls 18369->18372 18373 7ff6d3b44560 10 API calls 18370->18373 18371 7ff6d3b4c550 _log10_special 8 API calls 18374 7ff6d3b4336e 18371->18374 18372->18370 18375 7ff6d3b4641d 18373->18375 18374->16420 18392 7ff6d3b46500 18374->18392 18376 7ff6d3b4642b 18375->18376 18378 7ff6d3b48e80 3 API calls 18375->18378 18377 7ff6d3b44630 49 API calls 18376->18377 18378->18376 18384->18371 18541 7ff6d3b45400 18392->18541 18651 7ff6d3b5b150 __GetCurrentState 45 API calls 18650->18651 18652 7ff6d3b5a3e1 18651->18652 18655 7ff6d3b5a504 18652->18655 18664 7ff6d3b63650 18655->18664 18690 7ff6d3b63608 18664->18690 18695 7ff6d3b602d8 EnterCriticalSection 18690->18695 18866 7ff6d3b608c8 18867 7ff6d3b608ec 18866->18867 18870 7ff6d3b608fc 18866->18870 18868 7ff6d3b54f08 _get_daylight 11 API calls 18867->18868 18890 7ff6d3b608f1 18868->18890 18869 7ff6d3b60bdc 18872 7ff6d3b54f08 _get_daylight 11 API calls 18869->18872 18870->18869 18871 7ff6d3b6091e 18870->18871 18873 7ff6d3b6093f 18871->18873 18997 7ff6d3b60f84 18871->18997 18874 7ff6d3b60be1 18872->18874 18877 7ff6d3b609b1 18873->18877 18879 7ff6d3b60965 18873->18879 18884 7ff6d3b609a5 18873->18884 18876 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18874->18876 18876->18890 18881 7ff6d3b5eb98 _get_daylight 11 API calls 18877->18881 18895 7ff6d3b60974 18877->18895 18878 7ff6d3b60a5e 18889 7ff6d3b60a7b 18878->18889 18896 7ff6d3b60acd 18878->18896 19012 7ff6d3b596c0 18879->19012 18885 7ff6d3b609c7 18881->18885 18883 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18883->18890 18884->18878 18884->18895 19018 7ff6d3b6712c 18884->19018 18891 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18885->18891 18887 7ff6d3b6098d 18887->18884 18898 7ff6d3b60f84 45 API calls 18887->18898 18888 7ff6d3b6096f 18893 7ff6d3b54f08 _get_daylight 11 API calls 18888->18893 18894 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18889->18894 18892 7ff6d3b609d5 18891->18892 18892->18884 18892->18895 18900 7ff6d3b5eb98 _get_daylight 11 API calls 18892->18900 18893->18895 18897 7ff6d3b60a84 18894->18897 18895->18883 18896->18895 18899 7ff6d3b633dc 40 API calls 18896->18899 18907 7ff6d3b60a89 18897->18907 19054 7ff6d3b633dc 18897->19054 18898->18884 18901 7ff6d3b60b0a 18899->18901 18902 7ff6d3b609f7 18900->18902 18903 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18901->18903 18905 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18902->18905 18906 7ff6d3b60b14 18903->18906 18905->18884 18906->18895 18906->18907 18908 7ff6d3b60bd0 18907->18908 18912 7ff6d3b5eb98 _get_daylight 11 API calls 18907->18912 18910 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18908->18910 18909 7ff6d3b60ab5 18911 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18909->18911 18910->18890 18911->18907 18913 7ff6d3b60b58 18912->18913 18914 7ff6d3b60b69 18913->18914 18915 7ff6d3b60b60 18913->18915 18917 7ff6d3b5a4a4 __std_exception_copy 37 API calls 18914->18917 18916 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18915->18916 18918 7ff6d3b60b67 18916->18918 18919 7ff6d3b60b78 18917->18919 18922 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18918->18922 18920 7ff6d3b60c0b 18919->18920 18921 7ff6d3b60b80 18919->18921 18924 7ff6d3b5a900 _isindst 17 API calls 18920->18924 19063 7ff6d3b67244 18921->19063 18922->18890 18925 7ff6d3b60c1f 18924->18925 18927 7ff6d3b60c48 18925->18927 18936 7ff6d3b60c58 18925->18936 18930 7ff6d3b54f08 _get_daylight 11 API calls 18927->18930 18928 7ff6d3b60ba7 18932 7ff6d3b54f08 _get_daylight 11 API calls 18928->18932 18929 7ff6d3b60bc8 18931 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18929->18931 18933 7ff6d3b60c4d 18930->18933 18931->18908 18934 7ff6d3b60bac 18932->18934 18937 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18934->18937 18935 7ff6d3b60f3b 18939 7ff6d3b54f08 _get_daylight 11 API calls 18935->18939 18936->18935 18938 7ff6d3b60c7a 18936->18938 18937->18918 18940 7ff6d3b60c97 18938->18940 19082 7ff6d3b6106c 18938->19082 18941 7ff6d3b60f40 18939->18941 18944 7ff6d3b60d0b 18940->18944 18946 7ff6d3b60cbf 18940->18946 18953 7ff6d3b60cff 18940->18953 18943 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18941->18943 18943->18933 18949 7ff6d3b5eb98 _get_daylight 11 API calls 18944->18949 18961 7ff6d3b60cce 18944->18961 18965 7ff6d3b60d33 18944->18965 18945 7ff6d3b60dbe 18956 7ff6d3b60ddb 18945->18956 18960 7ff6d3b60e2e 18945->18960 19097 7ff6d3b596fc 18946->19097 18954 7ff6d3b60d25 18949->18954 18951 7ff6d3b5eb98 _get_daylight 11 API calls 18957 7ff6d3b60d55 18951->18957 18952 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18952->18933 18953->18945 18953->18961 19103 7ff6d3b66fec 18953->19103 18958 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18954->18958 18955 7ff6d3b60cc9 18959 7ff6d3b54f08 _get_daylight 11 API calls 18955->18959 18962 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18956->18962 18963 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18957->18963 18958->18965 18959->18961 18960->18961 18968 7ff6d3b633dc 40 API calls 18960->18968 18961->18952 18966 7ff6d3b60de4 18962->18966 18963->18953 18964 7ff6d3b60ce7 18964->18953 18967 7ff6d3b6106c 45 API calls 18964->18967 18965->18951 18965->18953 18965->18961 18971 7ff6d3b633dc 40 API calls 18966->18971 18973 7ff6d3b60dea 18966->18973 18967->18953 18969 7ff6d3b60e6c 18968->18969 18970 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18969->18970 18972 7ff6d3b60e76 18970->18972 18975 7ff6d3b60e16 18971->18975 18972->18961 18972->18973 18974 7ff6d3b60f2f 18973->18974 18978 7ff6d3b5eb98 _get_daylight 11 API calls 18973->18978 18977 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18974->18977 18976 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18975->18976 18976->18973 18977->18933 18979 7ff6d3b60ebb 18978->18979 18980 7ff6d3b60ecc 18979->18980 18981 7ff6d3b60ec3 18979->18981 18983 7ff6d3b60474 37 API calls 18980->18983 18982 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18981->18982 18984 7ff6d3b60eca 18982->18984 18985 7ff6d3b60eda 18983->18985 18988 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18984->18988 18986 7ff6d3b60ee2 SetEnvironmentVariableW 18985->18986 18987 7ff6d3b60f6f 18985->18987 18989 7ff6d3b60f27 18986->18989 18990 7ff6d3b60f06 18986->18990 18991 7ff6d3b5a900 _isindst 17 API calls 18987->18991 18988->18933 18993 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18989->18993 18994 7ff6d3b54f08 _get_daylight 11 API calls 18990->18994 18992 7ff6d3b60f83 18991->18992 18993->18974 18995 7ff6d3b60f0b 18994->18995 18996 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18995->18996 18996->18984 18998 7ff6d3b60fb9 18997->18998 18999 7ff6d3b60fa1 18997->18999 19000 7ff6d3b5eb98 _get_daylight 11 API calls 18998->19000 18999->18873 19007 7ff6d3b60fdd 19000->19007 19001 7ff6d3b61062 19003 7ff6d3b5a504 __GetCurrentState 45 API calls 19001->19003 19002 7ff6d3b6103e 19004 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19002->19004 19005 7ff6d3b61068 19003->19005 19004->18999 19006 7ff6d3b5eb98 _get_daylight 11 API calls 19006->19007 19007->19001 19007->19002 19007->19006 19008 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19007->19008 19009 7ff6d3b5a4a4 __std_exception_copy 37 API calls 19007->19009 19010 7ff6d3b6104d 19007->19010 19008->19007 19009->19007 19011 7ff6d3b5a900 _isindst 17 API calls 19010->19011 19011->19001 19013 7ff6d3b596d0 19012->19013 19017 7ff6d3b596d9 19012->19017 19013->19017 19127 7ff6d3b59198 19013->19127 19017->18887 19017->18888 19019 7ff6d3b67139 19018->19019 19020 7ff6d3b66254 19018->19020 19022 7ff6d3b54f4c 45 API calls 19019->19022 19021 7ff6d3b66261 19020->19021 19027 7ff6d3b66297 19020->19027 19025 7ff6d3b54f08 _get_daylight 11 API calls 19021->19025 19040 7ff6d3b66208 19021->19040 19024 7ff6d3b6716d 19022->19024 19023 7ff6d3b662c1 19026 7ff6d3b54f08 _get_daylight 11 API calls 19023->19026 19028 7ff6d3b67172 19024->19028 19032 7ff6d3b67183 19024->19032 19035 7ff6d3b6719a 19024->19035 19029 7ff6d3b6626b 19025->19029 19030 7ff6d3b662c6 19026->19030 19027->19023 19031 7ff6d3b662e6 19027->19031 19028->18884 19033 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 19029->19033 19034 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 19030->19034 19041 7ff6d3b54f4c 45 API calls 19031->19041 19046 7ff6d3b662d1 19031->19046 19036 7ff6d3b54f08 _get_daylight 11 API calls 19032->19036 19037 7ff6d3b66276 19033->19037 19034->19046 19038 7ff6d3b671b6 19035->19038 19039 7ff6d3b671a4 19035->19039 19042 7ff6d3b67188 19036->19042 19037->18884 19044 7ff6d3b671c7 19038->19044 19045 7ff6d3b671de 19038->19045 19043 7ff6d3b54f08 _get_daylight 11 API calls 19039->19043 19040->18884 19041->19046 19047 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 19042->19047 19048 7ff6d3b671a9 19043->19048 19359 7ff6d3b662a4 19044->19359 19368 7ff6d3b68f4c 19045->19368 19046->18884 19047->19028 19051 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 19048->19051 19051->19028 19053 7ff6d3b54f08 _get_daylight 11 API calls 19053->19028 19055 7ff6d3b633fe 19054->19055 19058 7ff6d3b6341b 19054->19058 19056 7ff6d3b6340c 19055->19056 19055->19058 19059 7ff6d3b54f08 _get_daylight 11 API calls 19056->19059 19057 7ff6d3b63425 19415 7ff6d3b67c74 19057->19415 19058->19057 19408 7ff6d3b67c38 19058->19408 19062 7ff6d3b63411 memcpy_s 19059->19062 19062->18909 19064 7ff6d3b54f4c 45 API calls 19063->19064 19065 7ff6d3b672aa 19064->19065 19067 7ff6d3b672b8 19065->19067 19427 7ff6d3b5ef24 19065->19427 19430 7ff6d3b554ac 19067->19430 19070 7ff6d3b673a4 19073 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19070->19073 19074 7ff6d3b673b5 19070->19074 19071 7ff6d3b54f4c 45 API calls 19072 7ff6d3b67327 19071->19072 19076 7ff6d3b5ef24 5 API calls 19072->19076 19079 7ff6d3b67330 19072->19079 19073->19074 19075 7ff6d3b60ba3 19074->19075 19077 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19074->19077 19075->18928 19075->18929 19076->19079 19077->19075 19078 7ff6d3b554ac 14 API calls 19080 7ff6d3b6738b 19078->19080 19079->19078 19080->19070 19081 7ff6d3b67393 SetEnvironmentVariableW 19080->19081 19081->19070 19083 7ff6d3b610ac 19082->19083 19089 7ff6d3b6108f 19082->19089 19084 7ff6d3b5eb98 _get_daylight 11 API calls 19083->19084 19092 7ff6d3b610d0 19084->19092 19085 7ff6d3b5a504 __GetCurrentState 45 API calls 19087 7ff6d3b6115a 19085->19087 19086 7ff6d3b61131 19088 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19086->19088 19088->19089 19089->18940 19090 7ff6d3b5eb98 _get_daylight 11 API calls 19090->19092 19091 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19091->19092 19092->19086 19092->19090 19092->19091 19093 7ff6d3b60474 37 API calls 19092->19093 19094 7ff6d3b61140 19092->19094 19096 7ff6d3b61154 19092->19096 19093->19092 19095 7ff6d3b5a900 _isindst 17 API calls 19094->19095 19095->19096 19096->19085 19098 7ff6d3b5970c 19097->19098 19101 7ff6d3b59715 19097->19101 19098->19101 19452 7ff6d3b5920c 19098->19452 19101->18955 19101->18964 19104 7ff6d3b66ff9 19103->19104 19108 7ff6d3b67026 19103->19108 19105 7ff6d3b66ffe 19104->19105 19104->19108 19106 7ff6d3b54f08 _get_daylight 11 API calls 19105->19106 19109 7ff6d3b67003 19106->19109 19107 7ff6d3b6706a 19110 7ff6d3b54f08 _get_daylight 11 API calls 19107->19110 19108->19107 19111 7ff6d3b67089 19108->19111 19122 7ff6d3b6705e __crtLCMapStringW 19108->19122 19112 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 19109->19112 19113 7ff6d3b6706f 19110->19113 19114 7ff6d3b67093 19111->19114 19115 7ff6d3b670a5 19111->19115 19116 7ff6d3b6700e 19112->19116 19117 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 19113->19117 19118 7ff6d3b54f08 _get_daylight 11 API calls 19114->19118 19119 7ff6d3b54f4c 45 API calls 19115->19119 19116->18953 19117->19122 19120 7ff6d3b67098 19118->19120 19121 7ff6d3b670b2 19119->19121 19123 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 19120->19123 19121->19122 19499 7ff6d3b68b08 19121->19499 19122->18953 19123->19122 19126 7ff6d3b54f08 _get_daylight 11 API calls 19126->19122 19128 7ff6d3b591ad 19127->19128 19129 7ff6d3b591b1 19127->19129 19128->19017 19142 7ff6d3b594ec 19128->19142 19150 7ff6d3b625f0 19129->19150 19134 7ff6d3b591c3 19136 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19134->19136 19135 7ff6d3b591cf 19176 7ff6d3b5927c 19135->19176 19136->19128 19139 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19140 7ff6d3b591f6 19139->19140 19141 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19140->19141 19141->19128 19143 7ff6d3b59515 19142->19143 19149 7ff6d3b5952e 19142->19149 19143->19017 19144 7ff6d3b5eb98 _get_daylight 11 API calls 19144->19149 19145 7ff6d3b595be 19147 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19145->19147 19146 7ff6d3b607e8 WideCharToMultiByte 19146->19149 19147->19143 19148 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19148->19149 19149->19143 19149->19144 19149->19145 19149->19146 19149->19148 19151 7ff6d3b625fd 19150->19151 19152 7ff6d3b591b6 19150->19152 19195 7ff6d3b5b224 19151->19195 19156 7ff6d3b6292c GetEnvironmentStringsW 19152->19156 19157 7ff6d3b6295c 19156->19157 19158 7ff6d3b591bb 19156->19158 19159 7ff6d3b607e8 WideCharToMultiByte 19157->19159 19158->19134 19158->19135 19160 7ff6d3b629ad 19159->19160 19161 7ff6d3b629b4 FreeEnvironmentStringsW 19160->19161 19162 7ff6d3b5d5fc _fread_nolock 12 API calls 19160->19162 19161->19158 19163 7ff6d3b629c7 19162->19163 19164 7ff6d3b629d8 19163->19164 19165 7ff6d3b629cf 19163->19165 19167 7ff6d3b607e8 WideCharToMultiByte 19164->19167 19166 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19165->19166 19168 7ff6d3b629d6 19166->19168 19169 7ff6d3b629fb 19167->19169 19168->19161 19170 7ff6d3b62a09 19169->19170 19171 7ff6d3b629ff 19169->19171 19173 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19170->19173 19172 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19171->19172 19174 7ff6d3b62a07 FreeEnvironmentStringsW 19172->19174 19173->19174 19174->19158 19177 7ff6d3b592a1 19176->19177 19178 7ff6d3b5eb98 _get_daylight 11 API calls 19177->19178 19190 7ff6d3b592d7 19178->19190 19179 7ff6d3b592df 19180 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19179->19180 19181 7ff6d3b591d7 19180->19181 19181->19139 19182 7ff6d3b59352 19183 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19182->19183 19183->19181 19184 7ff6d3b5eb98 _get_daylight 11 API calls 19184->19190 19185 7ff6d3b59341 19353 7ff6d3b594a8 19185->19353 19186 7ff6d3b5a4a4 __std_exception_copy 37 API calls 19186->19190 19189 7ff6d3b59377 19192 7ff6d3b5a900 _isindst 17 API calls 19189->19192 19190->19179 19190->19182 19190->19184 19190->19185 19190->19186 19190->19189 19193 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19190->19193 19191 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19191->19179 19194 7ff6d3b5938a 19192->19194 19193->19190 19196 7ff6d3b5b235 FlsGetValue 19195->19196 19197 7ff6d3b5b250 FlsSetValue 19195->19197 19198 7ff6d3b5b24a 19196->19198 19199 7ff6d3b5b242 19196->19199 19197->19199 19200 7ff6d3b5b25d 19197->19200 19198->19197 19201 7ff6d3b5b248 19199->19201 19202 7ff6d3b5a504 __GetCurrentState 45 API calls 19199->19202 19203 7ff6d3b5eb98 _get_daylight 11 API calls 19200->19203 19215 7ff6d3b622c4 19201->19215 19204 7ff6d3b5b2c5 19202->19204 19205 7ff6d3b5b26c 19203->19205 19206 7ff6d3b5b28a FlsSetValue 19205->19206 19207 7ff6d3b5b27a FlsSetValue 19205->19207 19209 7ff6d3b5b296 FlsSetValue 19206->19209 19210 7ff6d3b5b2a8 19206->19210 19208 7ff6d3b5b283 19207->19208 19211 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19208->19211 19209->19208 19212 7ff6d3b5aef4 _get_daylight 11 API calls 19210->19212 19211->19199 19213 7ff6d3b5b2b0 19212->19213 19214 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19213->19214 19214->19201 19238 7ff6d3b62534 19215->19238 19217 7ff6d3b622f9 19253 7ff6d3b61fc4 19217->19253 19220 7ff6d3b62316 19220->19152 19221 7ff6d3b5d5fc _fread_nolock 12 API calls 19222 7ff6d3b62327 19221->19222 19223 7ff6d3b6232f 19222->19223 19225 7ff6d3b6233e 19222->19225 19224 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19223->19224 19224->19220 19225->19225 19260 7ff6d3b6266c 19225->19260 19228 7ff6d3b6243a 19229 7ff6d3b54f08 _get_daylight 11 API calls 19228->19229 19231 7ff6d3b6243f 19229->19231 19230 7ff6d3b62495 19233 7ff6d3b624fc 19230->19233 19271 7ff6d3b61df4 19230->19271 19234 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19231->19234 19232 7ff6d3b62454 19232->19230 19235 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19232->19235 19237 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19233->19237 19234->19220 19235->19230 19237->19220 19239 7ff6d3b62557 19238->19239 19240 7ff6d3b62561 19239->19240 19286 7ff6d3b602d8 EnterCriticalSection 19239->19286 19242 7ff6d3b625d3 19240->19242 19245 7ff6d3b5a504 __GetCurrentState 45 API calls 19240->19245 19242->19217 19247 7ff6d3b625eb 19245->19247 19248 7ff6d3b62642 19247->19248 19250 7ff6d3b5b224 50 API calls 19247->19250 19248->19217 19251 7ff6d3b6262c 19250->19251 19252 7ff6d3b622c4 65 API calls 19251->19252 19252->19248 19254 7ff6d3b54f4c 45 API calls 19253->19254 19255 7ff6d3b61fd8 19254->19255 19256 7ff6d3b61ff6 19255->19256 19257 7ff6d3b61fe4 GetOEMCP 19255->19257 19258 7ff6d3b61ffb GetACP 19256->19258 19259 7ff6d3b6200b 19256->19259 19257->19259 19258->19259 19259->19220 19259->19221 19261 7ff6d3b61fc4 47 API calls 19260->19261 19262 7ff6d3b62699 19261->19262 19263 7ff6d3b627ef 19262->19263 19264 7ff6d3b626d6 IsValidCodePage 19262->19264 19270 7ff6d3b626f0 memcpy_s 19262->19270 19265 7ff6d3b4c550 _log10_special 8 API calls 19263->19265 19264->19263 19267 7ff6d3b626e7 19264->19267 19266 7ff6d3b62431 19265->19266 19266->19228 19266->19232 19268 7ff6d3b62716 GetCPInfo 19267->19268 19267->19270 19268->19263 19268->19270 19287 7ff6d3b620dc 19270->19287 19352 7ff6d3b602d8 EnterCriticalSection 19271->19352 19288 7ff6d3b62119 GetCPInfo 19287->19288 19289 7ff6d3b6220f 19287->19289 19288->19289 19294 7ff6d3b6212c 19288->19294 19290 7ff6d3b4c550 _log10_special 8 API calls 19289->19290 19292 7ff6d3b622ae 19290->19292 19291 7ff6d3b62e40 48 API calls 19293 7ff6d3b621a3 19291->19293 19292->19263 19298 7ff6d3b67b84 19293->19298 19294->19291 19297 7ff6d3b67b84 54 API calls 19297->19289 19299 7ff6d3b54f4c 45 API calls 19298->19299 19300 7ff6d3b67ba9 19299->19300 19303 7ff6d3b67850 19300->19303 19304 7ff6d3b67891 19303->19304 19305 7ff6d3b5f8a0 _fread_nolock MultiByteToWideChar 19304->19305 19307 7ff6d3b678db 19305->19307 19306 7ff6d3b4c550 _log10_special 8 API calls 19308 7ff6d3b621d6 19306->19308 19309 7ff6d3b67a11 19307->19309 19310 7ff6d3b5d5fc _fread_nolock 12 API calls 19307->19310 19311 7ff6d3b67b59 19307->19311 19312 7ff6d3b67913 19307->19312 19308->19297 19309->19311 19313 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19309->19313 19310->19312 19311->19306 19312->19309 19314 7ff6d3b5f8a0 _fread_nolock MultiByteToWideChar 19312->19314 19313->19311 19315 7ff6d3b67986 19314->19315 19315->19309 19334 7ff6d3b5f0e4 19315->19334 19318 7ff6d3b67a22 19320 7ff6d3b5d5fc _fread_nolock 12 API calls 19318->19320 19322 7ff6d3b67af4 19318->19322 19324 7ff6d3b67a40 19318->19324 19319 7ff6d3b679d1 19319->19309 19321 7ff6d3b5f0e4 __crtLCMapStringW 6 API calls 19319->19321 19320->19324 19321->19309 19322->19309 19323 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19322->19323 19323->19309 19324->19309 19325 7ff6d3b5f0e4 __crtLCMapStringW 6 API calls 19324->19325 19326 7ff6d3b67ac0 19325->19326 19326->19322 19327 7ff6d3b67af6 19326->19327 19328 7ff6d3b67ae0 19326->19328 19330 7ff6d3b607e8 WideCharToMultiByte 19327->19330 19329 7ff6d3b607e8 WideCharToMultiByte 19328->19329 19331 7ff6d3b67aee 19329->19331 19330->19331 19331->19322 19332 7ff6d3b67b0e 19331->19332 19332->19309 19333 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19332->19333 19333->19309 19340 7ff6d3b5ed10 19334->19340 19337 7ff6d3b5f12a 19337->19309 19337->19318 19337->19319 19339 7ff6d3b5f193 LCMapStringW 19339->19337 19341 7ff6d3b5ed6d 19340->19341 19343 7ff6d3b5ed68 __vcrt_InitializeCriticalSectionEx 19340->19343 19341->19337 19349 7ff6d3b5f1d0 19341->19349 19342 7ff6d3b5ed9d LoadLibraryExW 19345 7ff6d3b5ee72 19342->19345 19346 7ff6d3b5edc2 GetLastError 19342->19346 19343->19341 19343->19342 19344 7ff6d3b5ee92 GetProcAddress 19343->19344 19348 7ff6d3b5edfc LoadLibraryExW 19343->19348 19344->19341 19345->19344 19347 7ff6d3b5ee89 FreeLibrary 19345->19347 19346->19343 19347->19344 19348->19343 19348->19345 19350 7ff6d3b5ed10 __crtLCMapStringW 5 API calls 19349->19350 19351 7ff6d3b5f1fe __crtLCMapStringW 19350->19351 19351->19339 19354 7ff6d3b594ad 19353->19354 19355 7ff6d3b59349 19353->19355 19356 7ff6d3b594d6 19354->19356 19357 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19354->19357 19355->19191 19358 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19356->19358 19357->19354 19358->19355 19360 7ff6d3b662d8 19359->19360 19361 7ff6d3b662c1 19359->19361 19360->19361 19365 7ff6d3b662e6 19360->19365 19362 7ff6d3b54f08 _get_daylight 11 API calls 19361->19362 19363 7ff6d3b662c6 19362->19363 19364 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 19363->19364 19367 7ff6d3b662d1 19364->19367 19366 7ff6d3b54f4c 45 API calls 19365->19366 19365->19367 19366->19367 19367->19028 19369 7ff6d3b54f4c 45 API calls 19368->19369 19370 7ff6d3b68f71 19369->19370 19373 7ff6d3b68bc8 19370->19373 19377 7ff6d3b68c16 19373->19377 19374 7ff6d3b4c550 _log10_special 8 API calls 19375 7ff6d3b67205 19374->19375 19375->19028 19375->19053 19376 7ff6d3b68c9d 19378 7ff6d3b5f8a0 _fread_nolock MultiByteToWideChar 19376->19378 19382 7ff6d3b68ca1 19376->19382 19377->19376 19379 7ff6d3b68c88 GetCPInfo 19377->19379 19377->19382 19380 7ff6d3b68d35 19378->19380 19379->19376 19379->19382 19381 7ff6d3b5d5fc _fread_nolock 12 API calls 19380->19381 19380->19382 19383 7ff6d3b68d6c 19380->19383 19381->19383 19382->19374 19383->19382 19384 7ff6d3b5f8a0 _fread_nolock MultiByteToWideChar 19383->19384 19385 7ff6d3b68dda 19384->19385 19386 7ff6d3b68ebc 19385->19386 19387 7ff6d3b5f8a0 _fread_nolock MultiByteToWideChar 19385->19387 19386->19382 19388 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19386->19388 19389 7ff6d3b68e00 19387->19389 19388->19382 19389->19386 19390 7ff6d3b5d5fc _fread_nolock 12 API calls 19389->19390 19391 7ff6d3b68e2d 19389->19391 19390->19391 19391->19386 19392 7ff6d3b5f8a0 _fread_nolock MultiByteToWideChar 19391->19392 19393 7ff6d3b68ea4 19392->19393 19394 7ff6d3b68eaa 19393->19394 19395 7ff6d3b68ec4 19393->19395 19394->19386 19397 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19394->19397 19402 7ff6d3b5ef68 19395->19402 19397->19386 19399 7ff6d3b68f03 19399->19382 19401 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19399->19401 19400 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19400->19399 19401->19382 19403 7ff6d3b5ed10 __crtLCMapStringW 5 API calls 19402->19403 19404 7ff6d3b5efa6 19403->19404 19405 7ff6d3b5efae 19404->19405 19406 7ff6d3b5f1d0 __crtLCMapStringW 5 API calls 19404->19406 19405->19399 19405->19400 19407 7ff6d3b5f017 CompareStringW 19406->19407 19407->19405 19409 7ff6d3b67c5a HeapSize 19408->19409 19410 7ff6d3b67c41 19408->19410 19411 7ff6d3b54f08 _get_daylight 11 API calls 19410->19411 19412 7ff6d3b67c46 19411->19412 19413 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 19412->19413 19414 7ff6d3b67c51 19413->19414 19414->19057 19416 7ff6d3b67c89 19415->19416 19417 7ff6d3b67c93 19415->19417 19418 7ff6d3b5d5fc _fread_nolock 12 API calls 19416->19418 19419 7ff6d3b67c98 19417->19419 19425 7ff6d3b67c9f _get_daylight 19417->19425 19423 7ff6d3b67c91 19418->19423 19420 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19419->19420 19420->19423 19421 7ff6d3b67cd2 HeapReAlloc 19421->19423 19421->19425 19422 7ff6d3b67ca5 19424 7ff6d3b54f08 _get_daylight 11 API calls 19422->19424 19423->19062 19424->19423 19425->19421 19425->19422 19426 7ff6d3b63590 _get_daylight 2 API calls 19425->19426 19426->19425 19428 7ff6d3b5ed10 __crtLCMapStringW 5 API calls 19427->19428 19429 7ff6d3b5ef44 19428->19429 19429->19067 19431 7ff6d3b554fa 19430->19431 19432 7ff6d3b554d6 19430->19432 19434 7ff6d3b55554 19431->19434 19435 7ff6d3b554ff 19431->19435 19433 7ff6d3b554e5 19432->19433 19437 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19432->19437 19433->19070 19433->19071 19436 7ff6d3b5f8a0 _fread_nolock MultiByteToWideChar 19434->19436 19435->19433 19438 7ff6d3b55514 19435->19438 19441 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19435->19441 19439 7ff6d3b55570 19436->19439 19437->19433 19442 7ff6d3b5d5fc _fread_nolock 12 API calls 19438->19442 19440 7ff6d3b55577 GetLastError 19439->19440 19444 7ff6d3b555b2 19439->19444 19447 7ff6d3b555a5 19439->19447 19450 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19439->19450 19443 7ff6d3b54e7c _fread_nolock 11 API calls 19440->19443 19441->19438 19442->19433 19446 7ff6d3b55584 19443->19446 19444->19433 19445 7ff6d3b5f8a0 _fread_nolock MultiByteToWideChar 19444->19445 19448 7ff6d3b555f6 19445->19448 19449 7ff6d3b54f08 _get_daylight 11 API calls 19446->19449 19451 7ff6d3b5d5fc _fread_nolock 12 API calls 19447->19451 19448->19433 19448->19440 19449->19433 19450->19447 19451->19444 19453 7ff6d3b59225 19452->19453 19454 7ff6d3b59221 19452->19454 19473 7ff6d3b62a3c GetEnvironmentStringsW 19453->19473 19454->19101 19465 7ff6d3b595cc 19454->19465 19457 7ff6d3b59232 19459 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19457->19459 19458 7ff6d3b5923e 19480 7ff6d3b5938c 19458->19480 19459->19454 19462 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19463 7ff6d3b59265 19462->19463 19464 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19463->19464 19464->19454 19466 7ff6d3b595ef 19465->19466 19471 7ff6d3b59606 19465->19471 19466->19101 19467 7ff6d3b5eb98 _get_daylight 11 API calls 19467->19471 19468 7ff6d3b5967a 19470 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19468->19470 19469 7ff6d3b5f8a0 MultiByteToWideChar _fread_nolock 19469->19471 19470->19466 19471->19466 19471->19467 19471->19468 19471->19469 19472 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19471->19472 19472->19471 19474 7ff6d3b5922a 19473->19474 19475 7ff6d3b62a60 19473->19475 19474->19457 19474->19458 19475->19475 19476 7ff6d3b5d5fc _fread_nolock 12 API calls 19475->19476 19477 7ff6d3b62a97 memcpy_s 19476->19477 19478 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19477->19478 19479 7ff6d3b62ab7 FreeEnvironmentStringsW 19478->19479 19479->19474 19481 7ff6d3b593b4 19480->19481 19482 7ff6d3b5eb98 _get_daylight 11 API calls 19481->19482 19494 7ff6d3b593ef 19482->19494 19483 7ff6d3b593f7 19484 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19483->19484 19485 7ff6d3b59246 19484->19485 19485->19462 19486 7ff6d3b59471 19487 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19486->19487 19487->19485 19488 7ff6d3b5eb98 _get_daylight 11 API calls 19488->19494 19489 7ff6d3b59460 19491 7ff6d3b594a8 11 API calls 19489->19491 19490 7ff6d3b60474 37 API calls 19490->19494 19492 7ff6d3b59468 19491->19492 19495 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19492->19495 19493 7ff6d3b59494 19496 7ff6d3b5a900 _isindst 17 API calls 19493->19496 19494->19483 19494->19486 19494->19488 19494->19489 19494->19490 19494->19493 19497 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19494->19497 19495->19483 19498 7ff6d3b594a6 19496->19498 19497->19494 19501 7ff6d3b68b31 __crtLCMapStringW 19499->19501 19500 7ff6d3b670ee 19500->19122 19500->19126 19501->19500 19502 7ff6d3b5ef68 6 API calls 19501->19502 19502->19500 20467 7ff6d3b4cb50 20468 7ff6d3b4cb60 20467->20468 20484 7ff6d3b59ba8 20468->20484 20470 7ff6d3b4cb6c 20490 7ff6d3b4ce48 20470->20490 20472 7ff6d3b4cbd9 20473 7ff6d3b4d12c 7 API calls 20472->20473 20483 7ff6d3b4cbf5 20472->20483 20474 7ff6d3b4cc05 20473->20474 20475 7ff6d3b4cb84 _RTC_Initialize 20475->20472 20495 7ff6d3b4cff8 20475->20495 20477 7ff6d3b4cb99 20498 7ff6d3b59014 20477->20498 20485 7ff6d3b59bb9 20484->20485 20486 7ff6d3b59bc1 20485->20486 20487 7ff6d3b54f08 _get_daylight 11 API calls 20485->20487 20486->20470 20488 7ff6d3b59bd0 20487->20488 20489 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 20488->20489 20489->20486 20491 7ff6d3b4ce59 20490->20491 20494 7ff6d3b4ce5e __scrt_release_startup_lock 20490->20494 20492 7ff6d3b4d12c 7 API calls 20491->20492 20491->20494 20493 7ff6d3b4ced2 20492->20493 20494->20475 20523 7ff6d3b4cfbc 20495->20523 20497 7ff6d3b4d001 20497->20477 20499 7ff6d3b59034 20498->20499 20506 7ff6d3b4cba5 20498->20506 20500 7ff6d3b5903c 20499->20500 20501 7ff6d3b59052 GetModuleFileNameW 20499->20501 20502 7ff6d3b54f08 _get_daylight 11 API calls 20500->20502 20504 7ff6d3b5907d 20501->20504 20503 7ff6d3b59041 20502->20503 20505 7ff6d3b5a8e0 _invalid_parameter_noinfo 37 API calls 20503->20505 20507 7ff6d3b58fb4 11 API calls 20504->20507 20505->20506 20506->20472 20522 7ff6d3b4d0cc InitializeSListHead 20506->20522 20508 7ff6d3b590bd 20507->20508 20509 7ff6d3b590c5 20508->20509 20513 7ff6d3b590dd 20508->20513 20510 7ff6d3b54f08 _get_daylight 11 API calls 20509->20510 20511 7ff6d3b590ca 20510->20511 20512 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20511->20512 20512->20506 20514 7ff6d3b590ff 20513->20514 20516 7ff6d3b5912b 20513->20516 20517 7ff6d3b59144 20513->20517 20515 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20514->20515 20515->20506 20518 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20516->20518 20519 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20517->20519 20520 7ff6d3b59134 20518->20520 20519->20514 20521 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20520->20521 20521->20506 20524 7ff6d3b4cfd6 20523->20524 20526 7ff6d3b4cfcf 20523->20526 20527 7ff6d3b5a1ec 20524->20527 20526->20497 20530 7ff6d3b59e28 20527->20530 20537 7ff6d3b602d8 EnterCriticalSection 20530->20537 20302 7ff6d3b5afd0 20303 7ff6d3b5afd5 20302->20303 20304 7ff6d3b5afea 20302->20304 20308 7ff6d3b5aff0 20303->20308 20309 7ff6d3b5b032 20308->20309 20310 7ff6d3b5b03a 20308->20310 20311 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20309->20311 20312 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20310->20312 20311->20310 20313 7ff6d3b5b047 20312->20313 20314 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20313->20314 20315 7ff6d3b5b054 20314->20315 20316 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20315->20316 20317 7ff6d3b5b061 20316->20317 20318 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20317->20318 20319 7ff6d3b5b06e 20318->20319 20320 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20319->20320 20321 7ff6d3b5b07b 20320->20321 20322 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20321->20322 20323 7ff6d3b5b088 20322->20323 20324 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20323->20324 20325 7ff6d3b5b095 20324->20325 20326 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20325->20326 20327 7ff6d3b5b0a5 20326->20327 20328 7ff6d3b5a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20327->20328 20329 7ff6d3b5b0b5 20328->20329 20334 7ff6d3b5ae94 20329->20334 20348 7ff6d3b602d8 EnterCriticalSection 20334->20348 20538 7ff6d3b59d50 20541 7ff6d3b59ccc 20538->20541 20548 7ff6d3b602d8 EnterCriticalSection 20541->20548 20418 7ff6d3b6abe3 20419 7ff6d3b6abf3 20418->20419 20422 7ff6d3b55478 LeaveCriticalSection 20419->20422 19503 7ff6d3b4bae0 19504 7ff6d3b4bb0e 19503->19504 19505 7ff6d3b4baf5 19503->19505 19505->19504 19507 7ff6d3b5d5fc 12 API calls 19505->19507 19506 7ff6d3b4bb6e 19507->19506 20630 7ff6d3b6ad69 20633 7ff6d3b55478 LeaveCriticalSection 20630->20633

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 00007FF6D3B489E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 0 7ff6d3b489e0-7ff6d3b48b26 call 7ff6d3b4c850 call 7ff6d3b49390 SetConsoleCtrlHandler GetStartupInfoW call 7ff6d3b553f0 call 7ff6d3b5a47c call 7ff6d3b5871c call 7ff6d3b553f0 call 7ff6d3b5a47c call 7ff6d3b5871c call 7ff6d3b553f0 call 7ff6d3b5a47c call 7ff6d3b5871c GetCommandLineW CreateProcessW 23 7ff6d3b48b4d-7ff6d3b48b89 RegisterClassW 0->23 24 7ff6d3b48b28-7ff6d3b48b48 GetLastError call 7ff6d3b42c50 0->24 26 7ff6d3b48b8b GetLastError 23->26 27 7ff6d3b48b91-7ff6d3b48be5 CreateWindowExW 23->27 32 7ff6d3b48e39-7ff6d3b48e5f call 7ff6d3b4c550 24->32 26->27 29 7ff6d3b48be7-7ff6d3b48bed GetLastError 27->29 30 7ff6d3b48bef-7ff6d3b48bf4 ShowWindow 27->30 31 7ff6d3b48bfa-7ff6d3b48c0a WaitForSingleObject 29->31 30->31 33 7ff6d3b48c0c 31->33 34 7ff6d3b48c88-7ff6d3b48c8f 31->34 36 7ff6d3b48c10-7ff6d3b48c13 33->36 37 7ff6d3b48cd2-7ff6d3b48cd9 34->37 38 7ff6d3b48c91-7ff6d3b48ca1 WaitForSingleObject 34->38 40 7ff6d3b48c1b-7ff6d3b48c22 36->40 41 7ff6d3b48c15 GetLastError 36->41 44 7ff6d3b48cdf-7ff6d3b48cf5 QueryPerformanceFrequency QueryPerformanceCounter 37->44 45 7ff6d3b48dc0-7ff6d3b48dd9 GetMessageW 37->45 42 7ff6d3b48ca7-7ff6d3b48cb7 TerminateProcess 38->42 43 7ff6d3b48df8-7ff6d3b48e02 38->43 40->38 47 7ff6d3b48c24-7ff6d3b48c41 PeekMessageW 40->47 41->40 52 7ff6d3b48cb9 GetLastError 42->52 53 7ff6d3b48cbf-7ff6d3b48ccd WaitForSingleObject 42->53 50 7ff6d3b48e04-7ff6d3b48e0a DestroyWindow 43->50 51 7ff6d3b48e11-7ff6d3b48e35 GetExitCodeProcess CloseHandle * 2 43->51 46 7ff6d3b48d00-7ff6d3b48d38 MsgWaitForMultipleObjects PeekMessageW 44->46 48 7ff6d3b48ddb-7ff6d3b48de9 TranslateMessage DispatchMessageW 45->48 49 7ff6d3b48def-7ff6d3b48df6 45->49 54 7ff6d3b48d3a 46->54 55 7ff6d3b48d73-7ff6d3b48d7a 46->55 56 7ff6d3b48c76-7ff6d3b48c86 WaitForSingleObject 47->56 57 7ff6d3b48c43-7ff6d3b48c74 TranslateMessage DispatchMessageW PeekMessageW 47->57 48->49 49->43 49->45 50->51 51->32 52->53 53->43 58 7ff6d3b48d40-7ff6d3b48d71 TranslateMessage DispatchMessageW PeekMessageW 54->58 55->45 59 7ff6d3b48d7c-7ff6d3b48da5 QueryPerformanceCounter 55->59 56->34 56->36 57->56 57->57 58->55 58->58 59->46 60 7ff6d3b48dab-7ff6d3b48db2 59->60 60->43 61 7ff6d3b48db4-7ff6d3b48db8 60->61 61->45
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                          • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                          • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                          • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                          • Instruction ID: 1a4b0872c89b9a799d52e0a922e97baa2613b504d9c10ef69235978034e3f025
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DAD1A332B0AA8286E710CF35E8522ADB770FFA6758F400136DA9EE6695DF7CD164C740
                                                                                                                                                                                                                                          Function 00007FF6D3B41000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 62 7ff6d3b41000-7ff6d3b43806 call 7ff6d3b4fe18 call 7ff6d3b4fe20 call 7ff6d3b4c850 call 7ff6d3b553f0 call 7ff6d3b55484 call 7ff6d3b436b0 76 7ff6d3b43808-7ff6d3b4380f 62->76 77 7ff6d3b43814-7ff6d3b43836 call 7ff6d3b41950 62->77 79 7ff6d3b43c97-7ff6d3b43cb2 call 7ff6d3b4c550 76->79 82 7ff6d3b4383c-7ff6d3b43856 call 7ff6d3b41c80 77->82 83 7ff6d3b4391b-7ff6d3b43931 call 7ff6d3b445c0 77->83 87 7ff6d3b4385b-7ff6d3b4389b call 7ff6d3b48830 82->87 90 7ff6d3b4396a-7ff6d3b4397f call 7ff6d3b42710 83->90 91 7ff6d3b43933-7ff6d3b43960 call 7ff6d3b47f90 83->91 96 7ff6d3b4389d-7ff6d3b438a3 87->96 97 7ff6d3b438c1-7ff6d3b438cc call 7ff6d3b54f30 87->97 99 7ff6d3b43c8f 90->99 103 7ff6d3b43984-7ff6d3b439a6 call 7ff6d3b41c80 91->103 104 7ff6d3b43962-7ff6d3b43965 call 7ff6d3b5004c 91->104 100 7ff6d3b438af-7ff6d3b438bd call 7ff6d3b489a0 96->100 101 7ff6d3b438a5-7ff6d3b438ad 96->101 111 7ff6d3b439fc-7ff6d3b43a2a call 7ff6d3b48940 call 7ff6d3b489a0 * 3 97->111 112 7ff6d3b438d2-7ff6d3b438e1 call 7ff6d3b48830 97->112 99->79 100->97 101->100 115 7ff6d3b439b0-7ff6d3b439b9 103->115 104->90 138 7ff6d3b43a2f-7ff6d3b43a3e call 7ff6d3b48830 111->138 119 7ff6d3b438e7-7ff6d3b438ed 112->119 120 7ff6d3b439f4-7ff6d3b439f7 call 7ff6d3b54f30 112->120 115->115 118 7ff6d3b439bb-7ff6d3b439d8 call 7ff6d3b41950 115->118 118->87 130 7ff6d3b439de-7ff6d3b439ef call 7ff6d3b42710 118->130 123 7ff6d3b438f0-7ff6d3b438fc 119->123 120->111 127 7ff6d3b438fe-7ff6d3b43903 123->127 128 7ff6d3b43905-7ff6d3b43908 123->128 127->123 127->128 128->120 131 7ff6d3b4390e-7ff6d3b43916 call 7ff6d3b54f30 128->131 130->99 131->138 141 7ff6d3b43b45-7ff6d3b43b53 138->141 142 7ff6d3b43a44-7ff6d3b43a47 138->142 143 7ff6d3b43b59-7ff6d3b43b5d 141->143 144 7ff6d3b43a67 141->144 142->141 145 7ff6d3b43a4d-7ff6d3b43a50 142->145 146 7ff6d3b43a6b-7ff6d3b43a90 call 7ff6d3b54f30 143->146 144->146 147 7ff6d3b43a56-7ff6d3b43a5a 145->147 148 7ff6d3b43b14-7ff6d3b43b17 145->148 156 7ff6d3b43aab-7ff6d3b43ac0 146->156 157 7ff6d3b43a92-7ff6d3b43aa6 call 7ff6d3b48940 146->157 147->148 150 7ff6d3b43a60 147->150 151 7ff6d3b43b19-7ff6d3b43b1d 148->151 152 7ff6d3b43b2f-7ff6d3b43b40 call 7ff6d3b42710 148->152 150->144 151->152 153 7ff6d3b43b1f-7ff6d3b43b2a 151->153 160 7ff6d3b43c7f-7ff6d3b43c87 152->160 153->146 161 7ff6d3b43be8-7ff6d3b43bfa call 7ff6d3b48830 156->161 162 7ff6d3b43ac6-7ff6d3b43aca 156->162 157->156 160->99 170 7ff6d3b43bfc-7ff6d3b43c02 161->170 171 7ff6d3b43c2e 161->171 164 7ff6d3b43bcd-7ff6d3b43be2 call 7ff6d3b41940 162->164 165 7ff6d3b43ad0-7ff6d3b43ae8 call 7ff6d3b55250 162->165 164->161 164->162 175 7ff6d3b43aea-7ff6d3b43b02 call 7ff6d3b55250 165->175 176 7ff6d3b43b62-7ff6d3b43b7a call 7ff6d3b55250 165->176 173 7ff6d3b43c1e-7ff6d3b43c2c 170->173 174 7ff6d3b43c04-7ff6d3b43c1c 170->174 177 7ff6d3b43c31-7ff6d3b43c40 call 7ff6d3b54f30 171->177 173->177 174->177 175->164 186 7ff6d3b43b08-7ff6d3b43b0f 175->186 184 7ff6d3b43b87-7ff6d3b43b9f call 7ff6d3b55250 176->184 185 7ff6d3b43b7c-7ff6d3b43b80 176->185 187 7ff6d3b43c46-7ff6d3b43c4a 177->187 188 7ff6d3b43d41-7ff6d3b43d63 call 7ff6d3b444e0 177->188 201 7ff6d3b43bac-7ff6d3b43bc4 call 7ff6d3b55250 184->201 202 7ff6d3b43ba1-7ff6d3b43ba5 184->202 185->184 186->164 189 7ff6d3b43c50-7ff6d3b43c5f call 7ff6d3b490e0 187->189 190 7ff6d3b43cd4-7ff6d3b43ce6 call 7ff6d3b48830 187->190 199 7ff6d3b43d71-7ff6d3b43d82 call 7ff6d3b41c80 188->199 200 7ff6d3b43d65-7ff6d3b43d6f call 7ff6d3b44630 188->200 203 7ff6d3b43c61 189->203 204 7ff6d3b43cb3-7ff6d3b43cb6 call 7ff6d3b48660 189->204 205 7ff6d3b43ce8-7ff6d3b43ceb 190->205 206 7ff6d3b43d35-7ff6d3b43d3c 190->206 214 7ff6d3b43d87-7ff6d3b43d96 199->214 200->214 201->164 216 7ff6d3b43bc6 201->216 202->201 211 7ff6d3b43c68 call 7ff6d3b42710 203->211 221 7ff6d3b43cbb-7ff6d3b43cbd 204->221 205->206 212 7ff6d3b43ced-7ff6d3b43d10 call 7ff6d3b41c80 205->212 206->211 222 7ff6d3b43c6d-7ff6d3b43c77 211->222 228 7ff6d3b43d2b-7ff6d3b43d33 call 7ff6d3b54f30 212->228 229 7ff6d3b43d12-7ff6d3b43d26 call 7ff6d3b42710 call 7ff6d3b54f30 212->229 219 7ff6d3b43d98-7ff6d3b43d9f 214->219 220 7ff6d3b43dc4-7ff6d3b43dda call 7ff6d3b49390 214->220 216->164 219->220 224 7ff6d3b43da1-7ff6d3b43da5 219->224 232 7ff6d3b43de8-7ff6d3b43e04 SetDllDirectoryW 220->232 233 7ff6d3b43ddc 220->233 226 7ff6d3b43cc8-7ff6d3b43ccf 221->226 227 7ff6d3b43cbf-7ff6d3b43cc6 221->227 222->160 224->220 230 7ff6d3b43da7-7ff6d3b43dbe SetDllDirectoryW LoadLibraryExW 224->230 226->214 227->211 228->214 229->222 230->220 236 7ff6d3b43e0a-7ff6d3b43e19 call 7ff6d3b48830 232->236 237 7ff6d3b43f01-7ff6d3b43f08 232->237 233->232 251 7ff6d3b43e1b-7ff6d3b43e21 236->251 252 7ff6d3b43e32-7ff6d3b43e3c call 7ff6d3b54f30 236->252 242 7ff6d3b44008-7ff6d3b44010 237->242 243 7ff6d3b43f0e-7ff6d3b43f15 237->243 244 7ff6d3b44035-7ff6d3b44067 call 7ff6d3b436a0 call 7ff6d3b43360 call 7ff6d3b43670 call 7ff6d3b46fc0 call 7ff6d3b46d70 242->244 245 7ff6d3b44012-7ff6d3b4402f PostMessageW GetMessageW 242->245 243->242 248 7ff6d3b43f1b-7ff6d3b43f25 call 7ff6d3b433c0 243->248 245->244 248->222 258 7ff6d3b43f2b-7ff6d3b43f3f call 7ff6d3b490c0 248->258 255 7ff6d3b43e2d-7ff6d3b43e2f 251->255 256 7ff6d3b43e23-7ff6d3b43e2b 251->256 263 7ff6d3b43ef2-7ff6d3b43efc call 7ff6d3b48940 252->263 264 7ff6d3b43e42-7ff6d3b43e48 252->264 255->252 256->255 269 7ff6d3b43f41-7ff6d3b43f5e PostMessageW GetMessageW 258->269 270 7ff6d3b43f64-7ff6d3b43f7a call 7ff6d3b48940 call 7ff6d3b489e0 258->270 263->237 264->263 268 7ff6d3b43e4e-7ff6d3b43e54 264->268 272 7ff6d3b43e56-7ff6d3b43e58 268->272 273 7ff6d3b43e5f-7ff6d3b43e61 268->273 269->270 285 7ff6d3b43f7f-7ff6d3b43fa7 call 7ff6d3b46fc0 call 7ff6d3b46d70 call 7ff6d3b488e0 270->285 274 7ff6d3b43e67-7ff6d3b43e83 call 7ff6d3b46dc0 call 7ff6d3b47340 272->274 277 7ff6d3b43e5a 272->277 273->237 273->274 289 7ff6d3b43e8e-7ff6d3b43e95 274->289 290 7ff6d3b43e85-7ff6d3b43e8c 274->290 277->237 309 7ff6d3b43fa9-7ff6d3b43fbf call 7ff6d3b48ed0 call 7ff6d3b488e0 285->309 310 7ff6d3b43ff5-7ff6d3b44003 call 7ff6d3b41900 285->310 293 7ff6d3b43e97-7ff6d3b43ea4 call 7ff6d3b46e00 289->293 294 7ff6d3b43eaf-7ff6d3b43eb9 call 7ff6d3b471b0 289->294 292 7ff6d3b43edb-7ff6d3b43ef0 call 7ff6d3b42a50 call 7ff6d3b46fc0 call 7ff6d3b46d70 290->292 292->237 293->294 306 7ff6d3b43ea6-7ff6d3b43ead 293->306 307 7ff6d3b43ebb-7ff6d3b43ec2 294->307 308 7ff6d3b43ec4-7ff6d3b43ed2 call 7ff6d3b474f0 294->308 306->292 307->292 308->237 319 7ff6d3b43ed4 308->319 309->310 323 7ff6d3b43fc1-7ff6d3b43fd6 309->323 310->222 319->292 324 7ff6d3b43fd8-7ff6d3b43feb call 7ff6d3b42710 call 7ff6d3b41900 323->324 325 7ff6d3b43ff0 call 7ff6d3b42a50 323->325 324->222 325->310
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                          • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                          • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                          • Opcode ID: 2d77af2a2f9236e5f1bda1603447cca491bc739d444c9c91c5f96d0c69afedc5
                                                                                                                                                                                                                                          • Instruction ID: 6178b59478a5bc247db2dfda31e707857ce18bcc70a4b53cdbb6798e16cd8c5d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2d77af2a2f9236e5f1bda1603447cca491bc739d444c9c91c5f96d0c69afedc5
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4C32BE21A0E68651EA14EB25D4563BDA760AF6A788F484033DADDE72D2EF2CE574C304
                                                                                                                                                                                                                                          Function 00007FF6D3B65C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 479 7ff6d3b65c00-7ff6d3b65c3b call 7ff6d3b65588 call 7ff6d3b65590 call 7ff6d3b655f8 486 7ff6d3b65e65-7ff6d3b65eb1 call 7ff6d3b5a900 call 7ff6d3b65588 call 7ff6d3b65590 call 7ff6d3b655f8 479->486 487 7ff6d3b65c41-7ff6d3b65c4c call 7ff6d3b65598 479->487 513 7ff6d3b65eb7-7ff6d3b65ec2 call 7ff6d3b65598 486->513 514 7ff6d3b65fef-7ff6d3b6605d call 7ff6d3b5a900 call 7ff6d3b61578 486->514 487->486 492 7ff6d3b65c52-7ff6d3b65c5c 487->492 494 7ff6d3b65c7e-7ff6d3b65c82 492->494 495 7ff6d3b65c5e-7ff6d3b65c61 492->495 498 7ff6d3b65c85-7ff6d3b65c8d 494->498 497 7ff6d3b65c64-7ff6d3b65c6f 495->497 501 7ff6d3b65c7a-7ff6d3b65c7c 497->501 502 7ff6d3b65c71-7ff6d3b65c78 497->502 498->498 503 7ff6d3b65c8f-7ff6d3b65ca2 call 7ff6d3b5d5fc 498->503 501->494 506 7ff6d3b65cab-7ff6d3b65cb9 501->506 502->497 502->501 509 7ff6d3b65cba-7ff6d3b65cc6 call 7ff6d3b5a948 503->509 510 7ff6d3b65ca4-7ff6d3b65ca6 call 7ff6d3b5a948 503->510 520 7ff6d3b65ccd-7ff6d3b65cd5 509->520 510->506 513->514 522 7ff6d3b65ec8-7ff6d3b65ed3 call 7ff6d3b655c8 513->522 533 7ff6d3b6606b-7ff6d3b6606e 514->533 534 7ff6d3b6605f-7ff6d3b66066 514->534 520->520 523 7ff6d3b65cd7-7ff6d3b65ce8 call 7ff6d3b60474 520->523 522->514 531 7ff6d3b65ed9-7ff6d3b65efc call 7ff6d3b5a948 GetTimeZoneInformation 522->531 523->486 532 7ff6d3b65cee-7ff6d3b65d44 call 7ff6d3b6a4d0 * 4 call 7ff6d3b65b1c 523->532 548 7ff6d3b65f02-7ff6d3b65f23 531->548 549 7ff6d3b65fc4-7ff6d3b65fee call 7ff6d3b65580 call 7ff6d3b65570 call 7ff6d3b65578 531->549 591 7ff6d3b65d46-7ff6d3b65d4a 532->591 535 7ff6d3b660a5-7ff6d3b660b8 call 7ff6d3b5d5fc 533->535 536 7ff6d3b66070 533->536 539 7ff6d3b660fb-7ff6d3b660fe 534->539 558 7ff6d3b660ba 535->558 559 7ff6d3b660c3-7ff6d3b660de call 7ff6d3b61578 535->559 540 7ff6d3b66073 536->540 539->540 541 7ff6d3b66104-7ff6d3b6610c call 7ff6d3b65c00 539->541 545 7ff6d3b66078-7ff6d3b660a4 call 7ff6d3b5a948 call 7ff6d3b4c550 540->545 546 7ff6d3b66073 call 7ff6d3b65e7c 540->546 541->545 546->545 556 7ff6d3b65f25-7ff6d3b65f2b 548->556 557 7ff6d3b65f2e-7ff6d3b65f35 548->557 556->557 560 7ff6d3b65f37-7ff6d3b65f3f 557->560 561 7ff6d3b65f49 557->561 562 7ff6d3b660bc-7ff6d3b660c1 call 7ff6d3b5a948 558->562 579 7ff6d3b660e5-7ff6d3b660f7 call 7ff6d3b5a948 559->579 580 7ff6d3b660e0-7ff6d3b660e3 559->580 560->561 567 7ff6d3b65f41-7ff6d3b65f47 560->567 571 7ff6d3b65f4b-7ff6d3b65fbf call 7ff6d3b6a4d0 * 4 call 7ff6d3b62b5c call 7ff6d3b66114 * 2 561->571 562->536 567->571 571->549 579->539 580->562 593 7ff6d3b65d4c 591->593 594 7ff6d3b65d50-7ff6d3b65d54 591->594 593->594 594->591 596 7ff6d3b65d56-7ff6d3b65d7b call 7ff6d3b56b58 594->596 602 7ff6d3b65d7e-7ff6d3b65d82 596->602 604 7ff6d3b65d84-7ff6d3b65d8f 602->604 605 7ff6d3b65d91-7ff6d3b65d95 602->605 604->605 607 7ff6d3b65d97-7ff6d3b65d9b 604->607 605->602 610 7ff6d3b65d9d-7ff6d3b65dc5 call 7ff6d3b56b58 607->610 611 7ff6d3b65e1c-7ff6d3b65e20 607->611 619 7ff6d3b65dc7 610->619 620 7ff6d3b65de3-7ff6d3b65de7 610->620 613 7ff6d3b65e27-7ff6d3b65e34 611->613 614 7ff6d3b65e22-7ff6d3b65e24 611->614 615 7ff6d3b65e36-7ff6d3b65e4c call 7ff6d3b65b1c 613->615 616 7ff6d3b65e4f-7ff6d3b65e5e call 7ff6d3b65580 call 7ff6d3b65570 613->616 614->613 615->616 616->486 623 7ff6d3b65dca-7ff6d3b65dd1 619->623 620->611 625 7ff6d3b65de9-7ff6d3b65e07 call 7ff6d3b56b58 620->625 623->620 626 7ff6d3b65dd3-7ff6d3b65de1 623->626 631 7ff6d3b65e13-7ff6d3b65e1a 625->631 626->620 626->623 631->611 632 7ff6d3b65e09-7ff6d3b65e0d 631->632 632->611 633 7ff6d3b65e0f 632->633 633->631
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65C45
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B65598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B655AC
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A95E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: GetLastError.KERNEL32(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A968
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6D3B5A8DF,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5A909
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6D3B5A8DF,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5A92E
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65C34
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B655F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B6560C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65EAA
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65EBB
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65ECC
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D3B6610C), ref: 00007FF6D3B65EF3
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                          • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                          • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                          • Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                          • Instruction ID: 9e27e1146e42af99163d2fb78503c8f594fb74d4a6b816f1de2018bdf7ba58d8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9FD1E526E0A24246EB209F21D8522BDA751FFA6794F444037DA8DEB797DF3CE4718780
                                                                                                                                                                                                                                          Function 00007FF6D3B66964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 693 7ff6d3b66964-7ff6d3b669d7 call 7ff6d3b66698 696 7ff6d3b669d9-7ff6d3b669e2 call 7ff6d3b54ee8 693->696 697 7ff6d3b669f1-7ff6d3b669fb call 7ff6d3b58520 693->697 702 7ff6d3b669e5-7ff6d3b669ec call 7ff6d3b54f08 696->702 703 7ff6d3b669fd-7ff6d3b66a14 call 7ff6d3b54ee8 call 7ff6d3b54f08 697->703 704 7ff6d3b66a16-7ff6d3b66a7f CreateFileW 697->704 720 7ff6d3b66d32-7ff6d3b66d52 702->720 703->702 706 7ff6d3b66afc-7ff6d3b66b07 GetFileType 704->706 707 7ff6d3b66a81-7ff6d3b66a87 704->707 713 7ff6d3b66b5a-7ff6d3b66b61 706->713 714 7ff6d3b66b09-7ff6d3b66b44 GetLastError call 7ff6d3b54e7c CloseHandle 706->714 710 7ff6d3b66ac9-7ff6d3b66af7 GetLastError call 7ff6d3b54e7c 707->710 711 7ff6d3b66a89-7ff6d3b66a8d 707->711 710->702 711->710 718 7ff6d3b66a8f-7ff6d3b66ac7 CreateFileW 711->718 716 7ff6d3b66b69-7ff6d3b66b6c 713->716 717 7ff6d3b66b63-7ff6d3b66b67 713->717 714->702 728 7ff6d3b66b4a-7ff6d3b66b55 call 7ff6d3b54f08 714->728 723 7ff6d3b66b72-7ff6d3b66bc7 call 7ff6d3b58438 716->723 724 7ff6d3b66b6e 716->724 717->723 718->706 718->710 732 7ff6d3b66be6-7ff6d3b66c17 call 7ff6d3b66418 723->732 733 7ff6d3b66bc9-7ff6d3b66bd5 call 7ff6d3b668a0 723->733 724->723 728->702 738 7ff6d3b66c1d-7ff6d3b66c5f 732->738 739 7ff6d3b66c19-7ff6d3b66c1b 732->739 733->732 740 7ff6d3b66bd7 733->740 742 7ff6d3b66c81-7ff6d3b66c8c 738->742 743 7ff6d3b66c61-7ff6d3b66c65 738->743 741 7ff6d3b66bd9-7ff6d3b66be1 call 7ff6d3b5aac0 739->741 740->741 741->720 745 7ff6d3b66c92-7ff6d3b66c96 742->745 746 7ff6d3b66d30 742->746 743->742 744 7ff6d3b66c67-7ff6d3b66c7c 743->744 744->742 745->746 748 7ff6d3b66c9c-7ff6d3b66ce1 CloseHandle CreateFileW 745->748 746->720 750 7ff6d3b66d16-7ff6d3b66d2b 748->750 751 7ff6d3b66ce3-7ff6d3b66d11 GetLastError call 7ff6d3b54e7c call 7ff6d3b58660 748->751 750->746 751->750
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1617910340-0
                                                                                                                                                                                                                                          • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                          • Instruction ID: db3ac2e547953e502a48c5a2f8016e3b2a09ffff5bd25c90f41fb9fb3008d75e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 06C1D432B29A4589EB10CF65C4926BC7771FB5AB98B010236DE5EAB7D5CF38D061C340
                                                                                                                                                                                                                                          Function 00007FF6D3B65E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 959 7ff6d3b65e7c-7ff6d3b65eb1 call 7ff6d3b65588 call 7ff6d3b65590 call 7ff6d3b655f8 966 7ff6d3b65eb7-7ff6d3b65ec2 call 7ff6d3b65598 959->966 967 7ff6d3b65fef-7ff6d3b6605d call 7ff6d3b5a900 call 7ff6d3b61578 959->967 966->967 972 7ff6d3b65ec8-7ff6d3b65ed3 call 7ff6d3b655c8 966->972 979 7ff6d3b6606b-7ff6d3b6606e 967->979 980 7ff6d3b6605f-7ff6d3b66066 967->980 972->967 978 7ff6d3b65ed9-7ff6d3b65efc call 7ff6d3b5a948 GetTimeZoneInformation 972->978 992 7ff6d3b65f02-7ff6d3b65f23 978->992 993 7ff6d3b65fc4-7ff6d3b65fee call 7ff6d3b65580 call 7ff6d3b65570 call 7ff6d3b65578 978->993 981 7ff6d3b660a5-7ff6d3b660b8 call 7ff6d3b5d5fc 979->981 982 7ff6d3b66070 979->982 984 7ff6d3b660fb-7ff6d3b660fe 980->984 1000 7ff6d3b660ba 981->1000 1001 7ff6d3b660c3-7ff6d3b660de call 7ff6d3b61578 981->1001 985 7ff6d3b66073 982->985 984->985 986 7ff6d3b66104-7ff6d3b6610c call 7ff6d3b65c00 984->986 989 7ff6d3b66078-7ff6d3b660a4 call 7ff6d3b5a948 call 7ff6d3b4c550 985->989 990 7ff6d3b66073 call 7ff6d3b65e7c 985->990 986->989 990->989 998 7ff6d3b65f25-7ff6d3b65f2b 992->998 999 7ff6d3b65f2e-7ff6d3b65f35 992->999 998->999 1002 7ff6d3b65f37-7ff6d3b65f3f 999->1002 1003 7ff6d3b65f49 999->1003 1004 7ff6d3b660bc-7ff6d3b660c1 call 7ff6d3b5a948 1000->1004 1018 7ff6d3b660e5-7ff6d3b660f7 call 7ff6d3b5a948 1001->1018 1019 7ff6d3b660e0-7ff6d3b660e3 1001->1019 1002->1003 1008 7ff6d3b65f41-7ff6d3b65f47 1002->1008 1011 7ff6d3b65f4b-7ff6d3b65fbf call 7ff6d3b6a4d0 * 4 call 7ff6d3b62b5c call 7ff6d3b66114 * 2 1003->1011 1004->982 1008->1011 1011->993 1018->984 1019->1004
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65EAA
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B655F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B6560C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65EBB
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B65598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B655AC
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65ECC
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B655C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B655DC
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A95E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: GetLastError.KERNEL32(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A968
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D3B6610C), ref: 00007FF6D3B65EF3
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                          • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                          • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                          • Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                          • Instruction ID: 08b065096318db491f48ae166a327544f34530354a5bf9817533e1bbc6dc5555
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4519536E0A64246E710DF21D8835ADE760FB6A784F444137EA8DEB796DF3CE4608780
                                                                                                                                                                                                                                          Function 00007FF6D3B49280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                                                          • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                          • Instruction ID: 9e8543a07950f3cccdd1a06027269a512809f94802829efcc3a48c18142e2ea9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 64F0CD22E1A74186F7A08F50B48676EB350FB55728F040336D9ED616D4DF3CD058CA04
                                                                                                                                                                                                                                          Function 00007FF6D3B608C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1010374628-0
                                                                                                                                                                                                                                          • Opcode ID: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
                                                                                                                                                                                                                                          • Instruction ID: 1c54440f0cb689f8b171fdf984af31a2db398ad2c220a5abf8e03bc0c8135a64
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AF02AE21A1F65740FA55AB16980327DA684AF63BA0F498637DDDDFA3D3DE3CE4218340
                                                                                                                                                                                                                                          Function 00007FF6D3B41950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 331 7ff6d3b41950-7ff6d3b4198b call 7ff6d3b445c0 334 7ff6d3b41991-7ff6d3b419d1 call 7ff6d3b47f90 331->334 335 7ff6d3b41c4e-7ff6d3b41c72 call 7ff6d3b4c550 331->335 340 7ff6d3b419d7-7ff6d3b419e7 call 7ff6d3b506d4 334->340 341 7ff6d3b41c3b-7ff6d3b41c3e call 7ff6d3b5004c 334->341 346 7ff6d3b419e9-7ff6d3b41a03 call 7ff6d3b54f08 call 7ff6d3b42910 340->346 347 7ff6d3b41a08-7ff6d3b41a24 call 7ff6d3b5039c 340->347 345 7ff6d3b41c43-7ff6d3b41c4b 341->345 345->335 346->341 352 7ff6d3b41a26-7ff6d3b41a40 call 7ff6d3b54f08 call 7ff6d3b42910 347->352 353 7ff6d3b41a45-7ff6d3b41a5a call 7ff6d3b54f28 347->353 352->341 361 7ff6d3b41a5c-7ff6d3b41a76 call 7ff6d3b54f08 call 7ff6d3b42910 353->361 362 7ff6d3b41a7b-7ff6d3b41b05 call 7ff6d3b41c80 * 2 call 7ff6d3b506d4 call 7ff6d3b54f44 353->362 361->341 375 7ff6d3b41b0a-7ff6d3b41b14 362->375 376 7ff6d3b41b16-7ff6d3b41b30 call 7ff6d3b54f08 call 7ff6d3b42910 375->376 377 7ff6d3b41b35-7ff6d3b41b4e call 7ff6d3b5039c 375->377 376->341 382 7ff6d3b41b50-7ff6d3b41b6a call 7ff6d3b54f08 call 7ff6d3b42910 377->382 383 7ff6d3b41b6f-7ff6d3b41b8b call 7ff6d3b50110 377->383 382->341 391 7ff6d3b41b8d-7ff6d3b41b99 call 7ff6d3b42710 383->391 392 7ff6d3b41b9e-7ff6d3b41bac 383->392 391->341 392->341 395 7ff6d3b41bb2-7ff6d3b41bb9 392->395 397 7ff6d3b41bc1-7ff6d3b41bc7 395->397 398 7ff6d3b41bc9-7ff6d3b41bd6 397->398 399 7ff6d3b41be0-7ff6d3b41bef 397->399 400 7ff6d3b41bf1-7ff6d3b41bfa 398->400 399->399 399->400 401 7ff6d3b41bfc-7ff6d3b41bff 400->401 402 7ff6d3b41c0f 400->402 401->402 403 7ff6d3b41c01-7ff6d3b41c04 401->403 404 7ff6d3b41c11-7ff6d3b41c24 402->404 403->402 405 7ff6d3b41c06-7ff6d3b41c09 403->405 406 7ff6d3b41c26 404->406 407 7ff6d3b41c2d-7ff6d3b41c39 404->407 405->402 408 7ff6d3b41c0b-7ff6d3b41c0d 405->408 406->407 407->341 407->397 408->404
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B47F90: _fread_nolock.LIBCMT ref: 00007FF6D3B4803A
                                                                                                                                                                                                                                          • _fread_nolock.LIBCMT ref: 00007FF6D3B41A1B
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6D3B41B6A), ref: 00007FF6D3B4295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                          • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                          • Opcode ID: 507f08f26e205d920f148b85cad333997b9676a31346628d4d7d58e95cedc463
                                                                                                                                                                                                                                          • Instruction ID: 8f6936373afc2e4753a2f56edd1fbf91f064901a680496b08bc95a1b371624c7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 507f08f26e205d920f148b85cad333997b9676a31346628d4d7d58e95cedc463
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 94819071E0A68685EA10DB14D4432BDA3A0EB6A788F409433D9CDEB786DE3CE565CB44
                                                                                                                                                                                                                                          Function 00007FF6D3B41600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 409 7ff6d3b41600-7ff6d3b41611 410 7ff6d3b41637-7ff6d3b41651 call 7ff6d3b445c0 409->410 411 7ff6d3b41613-7ff6d3b4161c call 7ff6d3b41050 409->411 416 7ff6d3b41653-7ff6d3b41681 call 7ff6d3b54f08 call 7ff6d3b42910 410->416 417 7ff6d3b41682-7ff6d3b4169c call 7ff6d3b445c0 410->417 418 7ff6d3b4162e-7ff6d3b41636 411->418 419 7ff6d3b4161e-7ff6d3b41629 call 7ff6d3b42710 411->419 426 7ff6d3b416b8-7ff6d3b416cf call 7ff6d3b506d4 417->426 427 7ff6d3b4169e-7ff6d3b416b3 call 7ff6d3b42710 417->427 419->418 434 7ff6d3b416f9-7ff6d3b416fd 426->434 435 7ff6d3b416d1-7ff6d3b416f4 call 7ff6d3b54f08 call 7ff6d3b42910 426->435 433 7ff6d3b41821-7ff6d3b41824 call 7ff6d3b5004c 427->433 440 7ff6d3b41829-7ff6d3b4183b 433->440 437 7ff6d3b41717-7ff6d3b41737 call 7ff6d3b54f44 434->437 438 7ff6d3b416ff-7ff6d3b4170b call 7ff6d3b41210 434->438 448 7ff6d3b41819-7ff6d3b4181c call 7ff6d3b5004c 435->448 449 7ff6d3b41739-7ff6d3b4175c call 7ff6d3b54f08 call 7ff6d3b42910 437->449 450 7ff6d3b41761-7ff6d3b4176c 437->450 445 7ff6d3b41710-7ff6d3b41712 438->445 445->448 448->433 463 7ff6d3b4180f-7ff6d3b41814 449->463 452 7ff6d3b41802-7ff6d3b4180a call 7ff6d3b54f30 450->452 453 7ff6d3b41772-7ff6d3b41777 450->453 452->463 456 7ff6d3b41780-7ff6d3b417a2 call 7ff6d3b5039c 453->456 464 7ff6d3b417da-7ff6d3b417e6 call 7ff6d3b54f08 456->464 465 7ff6d3b417a4-7ff6d3b417bc call 7ff6d3b50adc 456->465 463->448 470 7ff6d3b417ed-7ff6d3b417f8 call 7ff6d3b42910 464->470 471 7ff6d3b417be-7ff6d3b417c1 465->471 472 7ff6d3b417c5-7ff6d3b417d8 call 7ff6d3b54f08 465->472 478 7ff6d3b417fd 470->478 471->456 474 7ff6d3b417c3 471->474 472->470 474->478 478->452
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                          • Opcode ID: 1024a7a5ee8cd7a3c756baff70d017aadc137d22fcd9cea75d224d6f76c21f88
                                                                                                                                                                                                                                          • Instruction ID: bc78aeb8a6337fff863a6c9edd62e7dbaae9e5939f4d04dc679c259a3d4a2096
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1024a7a5ee8cd7a3c756baff70d017aadc137d22fcd9cea75d224d6f76c21f88
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B51CF61F0A64392EA10EB52D4021BDA360BF6A798F444533ED8CEB7D6DE3CE564C744
                                                                                                                                                                                                                                          Function 00007FF6D3B48660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(?,?,00000000,00007FF6D3B43CBB), ref: 00007FF6D3B48704
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00007FF6D3B43CBB), ref: 00007FF6D3B4870A
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNELBASE(?,00000000,00007FF6D3B43CBB), ref: 00007FF6D3B4874C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48830: GetEnvironmentVariableW.KERNEL32(00007FF6D3B4388E), ref: 00007FF6D3B48867
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6D3B48889
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B58238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B58251
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42810: MessageBoxW.USER32 ref: 00007FF6D3B428EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                          • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                          • Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                          • Instruction ID: cb8e5c69851cf2656ac6427db11c9d2d210b6fe616c3060ebaf346441c1dfe08
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 30419111B1BA4244FA10A766E5572BD9390AF6B7C8F800033DD8DEB7DADE3DE5218344
                                                                                                                                                                                                                                          Function 00007FF6D3B41210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 756 7ff6d3b41210-7ff6d3b4126d call 7ff6d3b4bd80 759 7ff6d3b41297-7ff6d3b412af call 7ff6d3b54f44 756->759 760 7ff6d3b4126f-7ff6d3b41296 call 7ff6d3b42710 756->760 765 7ff6d3b412b1-7ff6d3b412cf call 7ff6d3b54f08 call 7ff6d3b42910 759->765 766 7ff6d3b412d4-7ff6d3b412e4 call 7ff6d3b54f44 759->766 777 7ff6d3b41439-7ff6d3b4144e call 7ff6d3b4ba60 call 7ff6d3b54f30 * 2 765->777 772 7ff6d3b41309-7ff6d3b4131b 766->772 773 7ff6d3b412e6-7ff6d3b41304 call 7ff6d3b54f08 call 7ff6d3b42910 766->773 776 7ff6d3b41320-7ff6d3b41345 call 7ff6d3b5039c 772->776 773->777 785 7ff6d3b4134b-7ff6d3b41355 call 7ff6d3b50110 776->785 786 7ff6d3b41431 776->786 793 7ff6d3b41453-7ff6d3b4146d 777->793 785->786 792 7ff6d3b4135b-7ff6d3b41367 785->792 786->777 794 7ff6d3b41370-7ff6d3b41398 call 7ff6d3b4a1c0 792->794 797 7ff6d3b41416-7ff6d3b4142c call 7ff6d3b42710 794->797 798 7ff6d3b4139a-7ff6d3b4139d 794->798 797->786 799 7ff6d3b41411 798->799 800 7ff6d3b4139f-7ff6d3b413a9 798->800 799->797 802 7ff6d3b413ab-7ff6d3b413b9 call 7ff6d3b50adc 800->802 803 7ff6d3b413d4-7ff6d3b413d7 800->803 809 7ff6d3b413be-7ff6d3b413c1 802->809 804 7ff6d3b413d9-7ff6d3b413e7 call 7ff6d3b69e30 803->804 805 7ff6d3b413ea-7ff6d3b413ef 803->805 804->805 805->794 808 7ff6d3b413f5-7ff6d3b413f8 805->808 811 7ff6d3b4140c-7ff6d3b4140f 808->811 812 7ff6d3b413fa-7ff6d3b413fd 808->812 813 7ff6d3b413cf-7ff6d3b413d2 809->813 814 7ff6d3b413c3-7ff6d3b413cd call 7ff6d3b50110 809->814 811->786 812->797 815 7ff6d3b413ff-7ff6d3b41407 812->815 813->797 814->805 814->813 815->776
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                          • Opcode ID: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
                                                                                                                                                                                                                                          • Instruction ID: 9a6e23897d47fe2df6572510d419b3fecb07d32fdc635b61f0a9720435380dd1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD51E622A0A64241EA60DB11E4423BEE290FFAA798F444136EDCDE77C5EF3CD525C704
                                                                                                                                                                                                                                          Function 00007FF6D3B436B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,00007FF6D3B43804), ref: 00007FF6D3B436E1
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B43804), ref: 00007FF6D3B436EB
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D3B43706,?,00007FF6D3B43804), ref: 00007FF6D3B42C9E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D3B43706,?,00007FF6D3B43804), ref: 00007FF6D3B42D63
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42C50: MessageBoxW.USER32 ref: 00007FF6D3B42D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                          • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                          • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                          • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                          • Instruction ID: 104751567110ef7d241d478da70b6c4771a0ab8b1a72206ac32e5c2b8b736bdd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8721B751F1E64241FA20AB20E8133BEA350BFAE388F444133D5DDE65D6EE2CE524C744
                                                                                                                                                                                                                                          Function 00007FF6D3B5BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 846 7ff6d3b5ba5c-7ff6d3b5ba82 847 7ff6d3b5ba9d-7ff6d3b5baa1 846->847 848 7ff6d3b5ba84-7ff6d3b5ba98 call 7ff6d3b54ee8 call 7ff6d3b54f08 846->848 850 7ff6d3b5be77-7ff6d3b5be83 call 7ff6d3b54ee8 call 7ff6d3b54f08 847->850 851 7ff6d3b5baa7-7ff6d3b5baae 847->851 864 7ff6d3b5be8e 848->864 870 7ff6d3b5be89 call 7ff6d3b5a8e0 850->870 851->850 853 7ff6d3b5bab4-7ff6d3b5bae2 851->853 853->850 856 7ff6d3b5bae8-7ff6d3b5baef 853->856 859 7ff6d3b5bb08-7ff6d3b5bb0b 856->859 860 7ff6d3b5baf1-7ff6d3b5bb03 call 7ff6d3b54ee8 call 7ff6d3b54f08 856->860 862 7ff6d3b5be73-7ff6d3b5be75 859->862 863 7ff6d3b5bb11-7ff6d3b5bb17 859->863 860->870 867 7ff6d3b5be91-7ff6d3b5bea8 862->867 863->862 868 7ff6d3b5bb1d-7ff6d3b5bb20 863->868 864->867 868->860 872 7ff6d3b5bb22-7ff6d3b5bb47 868->872 870->864 875 7ff6d3b5bb7a-7ff6d3b5bb81 872->875 876 7ff6d3b5bb49-7ff6d3b5bb4b 872->876 877 7ff6d3b5bb56-7ff6d3b5bb6d call 7ff6d3b54ee8 call 7ff6d3b54f08 call 7ff6d3b5a8e0 875->877 878 7ff6d3b5bb83-7ff6d3b5bbab call 7ff6d3b5d5fc call 7ff6d3b5a948 * 2 875->878 879 7ff6d3b5bb4d-7ff6d3b5bb54 876->879 880 7ff6d3b5bb72-7ff6d3b5bb78 876->880 912 7ff6d3b5bd00 877->912 907 7ff6d3b5bbad-7ff6d3b5bbc3 call 7ff6d3b54f08 call 7ff6d3b54ee8 878->907 908 7ff6d3b5bbc8-7ff6d3b5bbf3 call 7ff6d3b5c284 878->908 879->877 879->880 883 7ff6d3b5bbf8-7ff6d3b5bc0f 880->883 884 7ff6d3b5bc8a-7ff6d3b5bc94 call 7ff6d3b6391c 883->884 885 7ff6d3b5bc11-7ff6d3b5bc19 883->885 898 7ff6d3b5bc9a-7ff6d3b5bcaf 884->898 899 7ff6d3b5bd1e 884->899 885->884 888 7ff6d3b5bc1b-7ff6d3b5bc1d 885->888 888->884 892 7ff6d3b5bc1f-7ff6d3b5bc35 888->892 892->884 896 7ff6d3b5bc37-7ff6d3b5bc43 892->896 896->884 901 7ff6d3b5bc45-7ff6d3b5bc47 896->901 898->899 904 7ff6d3b5bcb1-7ff6d3b5bcc3 GetConsoleMode 898->904 903 7ff6d3b5bd23-7ff6d3b5bd43 ReadFile 899->903 901->884 906 7ff6d3b5bc49-7ff6d3b5bc61 901->906 909 7ff6d3b5be3d-7ff6d3b5be46 GetLastError 903->909 910 7ff6d3b5bd49-7ff6d3b5bd51 903->910 904->899 911 7ff6d3b5bcc5-7ff6d3b5bccd 904->911 906->884 916 7ff6d3b5bc63-7ff6d3b5bc6f 906->916 907->912 908->883 913 7ff6d3b5be48-7ff6d3b5be5e call 7ff6d3b54f08 call 7ff6d3b54ee8 909->913 914 7ff6d3b5be63-7ff6d3b5be66 909->914 910->909 918 7ff6d3b5bd57 910->918 911->903 920 7ff6d3b5bccf-7ff6d3b5bcf1 ReadConsoleW 911->920 915 7ff6d3b5bd03-7ff6d3b5bd0d call 7ff6d3b5a948 912->915 913->912 926 7ff6d3b5be6c-7ff6d3b5be6e 914->926 927 7ff6d3b5bcf9-7ff6d3b5bcfb call 7ff6d3b54e7c 914->927 915->867 916->884 925 7ff6d3b5bc71-7ff6d3b5bc73 916->925 929 7ff6d3b5bd5e-7ff6d3b5bd73 918->929 921 7ff6d3b5bcf3 GetLastError 920->921 922 7ff6d3b5bd12-7ff6d3b5bd1c 920->922 921->927 922->929 925->884 934 7ff6d3b5bc75-7ff6d3b5bc85 925->934 926->915 927->912 929->915 936 7ff6d3b5bd75-7ff6d3b5bd80 929->936 934->884 939 7ff6d3b5bda7-7ff6d3b5bdaf 936->939 940 7ff6d3b5bd82-7ff6d3b5bd9b call 7ff6d3b5b674 936->940 941 7ff6d3b5be2b-7ff6d3b5be38 call 7ff6d3b5b4b4 939->941 942 7ff6d3b5bdb1-7ff6d3b5bdc3 939->942 945 7ff6d3b5bda0-7ff6d3b5bda2 940->945 941->945 946 7ff6d3b5bdc5 942->946 947 7ff6d3b5be1e-7ff6d3b5be26 942->947 945->915 950 7ff6d3b5bdca-7ff6d3b5bdd1 946->950 947->915 951 7ff6d3b5be0d-7ff6d3b5be18 950->951 952 7ff6d3b5bdd3-7ff6d3b5bdd7 950->952 951->947 953 7ff6d3b5bdd9-7ff6d3b5bde0 952->953 954 7ff6d3b5bdf3 952->954 953->954 955 7ff6d3b5bde2-7ff6d3b5bde6 953->955 956 7ff6d3b5bdf9-7ff6d3b5be09 954->956 955->954 957 7ff6d3b5bde8-7ff6d3b5bdf1 955->957 956->950 958 7ff6d3b5be0b 956->958 957->956 958->947
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                          • Instruction ID: 09c10333cce9f1744bd21a5e6757d30378a463f928ad8cac17a69c9ba2d7adb8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B9C1082290E78A91E661DB15D0422BDBB50FBA3B80F554133EACDA77D1DFBCE4658B00
                                                                                                                                                                                                                                          Function 00007FF6D3B48570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 995526605-0
                                                                                                                                                                                                                                          • Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                          • Instruction ID: 19cc4d85126d133b276044d06981e1ec924809e135c16a9b86a40bc391ca4662
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1221C121A0DA4642EA508B19F44123EE3B0EF967A4F500232EAEDD7AE5DEBDD4158B00
                                                                                                                                                                                                                                          Function 00007FF6D3B490E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: GetCurrentProcess.KERNEL32 ref: 00007FF6D3B48590
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: OpenProcessToken.ADVAPI32 ref: 00007FF6D3B485A3
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: GetTokenInformation.KERNELBASE ref: 00007FF6D3B485C8
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: GetLastError.KERNEL32 ref: 00007FF6D3B485D2
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: GetTokenInformation.KERNELBASE ref: 00007FF6D3B48612
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6D3B4862E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: CloseHandle.KERNEL32 ref: 00007FF6D3B48646
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF6D3B43C55), ref: 00007FF6D3B4916C
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF6D3B43C55), ref: 00007FF6D3B49175
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                          • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                          • Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                                                          • Instruction ID: 127dc0b82d7034c2555e8ca363469eb2034c68354435cfc525f0ed2be430beaf
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 62214F21A0A74251E610AB50E9163FEB260FFAA784F444037EA8DE7796DF3CD8658780
                                                                                                                                                                                                                                          Function 00007FF6D3B47E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNELBASE(00000000,?,00007FF6D3B4352C,?,00000000,00007FF6D3B43F23), ref: 00007FF6D3B47F32
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectory
                                                                                                                                                                                                                                          • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                          • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                          • Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                                                          • Instruction ID: fd3d86969cd8b7030d98d8576f9107fd1577017d726ac8c0712edb20bbc0c756
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0331DA2171AAC545EA218B11E8133AEA354EF99BE4F440232EAFD977C9DF2CD615C704
                                                                                                                                                                                                                                          Function 00007FF6D3B5CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3B5CF4B), ref: 00007FF6D3B5D07C
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3B5CF4B), ref: 00007FF6D3B5D107
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 953036326-0
                                                                                                                                                                                                                                          • Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                          • Instruction ID: 5b780e0fedd5360abb6ab55b49325deaea709b1877f28af27e3490d8355b54ed
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8591D832F1A69185F7509F65D4422BDABA0BB66B88F14423BDE8EF7685CF38D452C700
                                                                                                                                                                                                                                          Function 00007FF6D3B5F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4170891091-0
                                                                                                                                                                                                                                          • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                          • Instruction ID: fb50f921f8bb759d4acef61e763385294a97efcea310e65d98ba60bd2199f5fe
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C9511773F06211CAEB18CF64D9566BCFB61AB66358F100236DD5DA2AE5DF38A4128700
                                                                                                                                                                                                                                          Function 00007FF6D3B5577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2780335769-0
                                                                                                                                                                                                                                          • Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
                                                                                                                                                                                                                                          • Instruction ID: a22426a67b73c91c601e54ac477b1deb45f494c138fd2290916a98df2901f0aa
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A051AF22E096458AFB10CF71D4523BDB7B1AF6AB59F104437DE8EAB689DF38D4608740
                                                                                                                                                                                                                                          Function 00007FF6D3B55628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1279662727-0
                                                                                                                                                                                                                                          • Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                          • Instruction ID: de892ab8e576f9c9ec8efd5da4867ca26454791ba687aa5cbf01c11f6515c15b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6A419062E2978283E6548B21D55137DB360FBA63A5F108336E69D93AD2DF6CE0F08700
                                                                                                                                                                                                                                          Function 00007FF6D3B4CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3251591375-0
                                                                                                                                                                                                                                          • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                          • Instruction ID: aa64f9fd9f9eb3647347caca1c74cc666e1bba92f27440f3d801f6fbd41c225c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59317020E4B14751FA10AB65D4133BDA3919F7BB88F445037D9CEEB2D3DE6CA4258349
                                                                                                                                                                                                                                          Function 00007FF6D3B5013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                          • Instruction ID: 96fc7fbe128566801c8badcdae99c0b129d55344f828d143bead31aae30dc847
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 06511821B0B24186F7649B25D40267EE680BFA6BA4F184636EDEDA77CDCE3CD5218701
                                                                                                                                                                                                                                          Function 00007FF6D3B5C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                                                          • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                          • Instruction ID: 4d962a753bcfec84b4b47e98d70167cfad78ec41fc9c3ac4f2edce97ce1b736e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86110421709A8181DA208B25E80517DE362AB52FF0F540332EEBD9B7D9CE7CD0618700
                                                                                                                                                                                                                                          Function 00007FF6D3B55924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3B55839), ref: 00007FF6D3B55957
                                                                                                                                                                                                                                          • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3B55839), ref: 00007FF6D3B5596D
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1707611234-0
                                                                                                                                                                                                                                          • Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                          • Instruction ID: 76ac30320aeae81e54e4da55a0c54c02a77e95638e4d1a444df991e0a751afda
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4118C3260D60282EA548B15E41203EF7A0FB96B72F500237FADAD59D8EF6CD424DB00
                                                                                                                                                                                                                                          Function 00007FF6D3B5A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RtlFreeHeap.NTDLL(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A95E
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A968
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                                                          • Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                          • Instruction ID: 354414d43e15152f63b4e89ecfa6f61b6e188eed0a02c77456b27488108e821e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 13E08610F0F60342FF499BF2E44713C93505FA7700F440036C88DF6292EE6CA8618710
                                                                                                                                                                                                                                          Function 00007FF6D3B5AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CloseHandle.KERNELBASE(?,?,?,00007FF6D3B5A9D5,?,?,00000000,00007FF6D3B5AA8A), ref: 00007FF6D3B5ABC6
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF6D3B5A9D5,?,?,00000000,00007FF6D3B5AA8A), ref: 00007FF6D3B5ABD0
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 918212764-0
                                                                                                                                                                                                                                          • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                          • Instruction ID: 132cc680452ce04a0582c0e36f1dbef21a0083cf91e9c361489536c7ba5ee46f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 57212B11F2E68201FED59751D48237DA7829FA6790F04023BDAAEF77C2CEACE4614300
                                                                                                                                                                                                                                          Function 00007FF6D3B5BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                          • Instruction ID: 9fe58b2c5fb5a79f0edf00a272c038c1cfe9c4c87b2a613c82425b2ee54e285f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F341C23290A74587EA74CA59E54227DB3A0EB67B81F140532DACEE36D1CFACE412CF50
                                                                                                                                                                                                                                          Function 00007FF6D3B47F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 840049012-0
                                                                                                                                                                                                                                          • Opcode ID: 12c7421bf9d851de3930d973ff4776f23e58c204998b3b00b1158df84cf7151e
                                                                                                                                                                                                                                          • Instruction ID: db0c0df018f09cc4e6a91f5e241a1df5cc7e462a0ac1757ed243338f64214688
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12c7421bf9d851de3930d973ff4776f23e58c204998b3b00b1158df84cf7151e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A21EC11B1AB5146FE509B12A4063BED651BF6BBC8F884432EE8CE7786CE7EE051C304
                                                                                                                                                                                                                                          Function 00007FF6D3B5B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                                                          • Instruction ID: f02b05b370c25ba479474696bc5911e5cb19f181860c125bf1bec6c4f52154f4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1031B522A1A64285F711AB55D84337CBA90BFA6B90F410137E99DE73D2CFBCE4618B11
                                                                                                                                                                                                                                          Function 00007FF6D3B55F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction ID: de4fb85de5844365e7777b540fa741c36dbe45e1fb195b71cc0a810ed0472b54
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CA118121A1E64282EA619F15D40217DE664AFA6B85F444433EACEF7A96CF3CE4604700
                                                                                                                                                                                                                                          Function 00007FF6D3B66354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                          • Instruction ID: bbeec0e428d4871c7576d64ca67d3e713fcad3995fc2dd46c427dd596002aa56
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1421D732A09A418BDB618F18D44237DB7A0FBE5B54F144235EA9DDB6D6DF3CD4218B00
                                                                                                                                                                                                                                          Function 00007FF6D3B503BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction ID: 6a41d3d70381d116d3f2c9a9f2efcd13a69ad6813b5beeccb1dadd258afbb232
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BF015261A1A74581E9049B52D9021BDE6A5AFE6FE1F484632EEDCA7BDACE3CD4214300
                                                                                                                                                                                                                                          Function 00007FF6D3B57EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
                                                                                                                                                                                                                                          • Instruction ID: 8b9edfcb2789c05fa9f1faa1aeb04dcffe0bf0fb81d5fa760187edb9f9904565
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DD015B20F1F78340FA90AA21A94317DA690EF667D0F544277EAACF66C6DF6CA4614310
                                                                                                                                                                                                                                          Function 00007FF6D3B58238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                          • Instruction ID: f130b26c36f0473f50126ed15367a02ac222e7e380fe26e9d5e467e5b1b01723
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 88E08650F0EB0647F65236A5C48317C95104FB7340F800032D98DF62C3DD2D68655321
                                                                                                                                                                                                                                          Function 00007FF6D3B5D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,?,00007FF6D3B50C90,?,?,?,00007FF6D3B522FA,?,?,?,?,?,00007FF6D3B53AE9), ref: 00007FF6D3B5D63A
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                                          • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                          • Instruction ID: d970c797800bee96f914447cc951fd45e90f5843ab3df35178c5586a59f90ed9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CFF08210F0B28780FE557B71D85327CA1904FE67A0F080736DDAEE62C2DD2CE4A18710

                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                          Function 00007FF6D3B45830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45840
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45852
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45889
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4589B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B458B4
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B458C6
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B458DF
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B458F1
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4590D
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4591F
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4593B
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4594D
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45969
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4597B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45997
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B459A9
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B459C5
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B459D7
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                          • API String ID: 199729137-653951865
                                                                                                                                                                                                                                          • Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                          • Instruction ID: f33626eff7058dd32c4baed28ad69f729829b27d3f3f97e3aad35f916dbeb42d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0022CE6090FF0B91FA15DB56A81257CA360AF3B745F445037C49EEA262FF7CA468C684
                                                                                                                                                                                                                                          Function 00007FF6D3B640AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                          • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                          • Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                          • Instruction ID: 72998a346cd7a79dde921a65d32a6ac755bb57037284c240ec5bbd60f9b1d017
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51B20A72F196824BE7258F64D4427FDB7A1FB66348F401136DA4DABA85DF38E910CB80
                                                                                                                                                                                                                                          Function 00007FF6D3B483C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B4842B
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484AE
                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484CD
                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484DB
                                                                                                                                                                                                                                          • FindClose.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484EC
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484F5
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                          • String ID: %s\*
                                                                                                                                                                                                                                          • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                          • Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                          • Instruction ID: 4024d86869051796e230551522bb4bbebeb91a5d9a0da31b5dccb9c9c9c54f5e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B41E521A0E94291EA20DB24F4461BEA3A0FBBA758F400233D5DEE36C5EF3DD555C744
                                                                                                                                                                                                                                          Function 00007FF6D3B4ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                                          • API String ID: 0-2665694366
                                                                                                                                                                                                                                          • Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                          • Instruction ID: 25dce45ddd53b40e928b34552396f4f6edf64e6b94405e038cb576c892d79322
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4F520572A196A58BD7A48F14C459BBDBBA9FB59344F01413AE6CAD3780DF7CD810CB40
                                                                                                                                                                                                                                          Function 00007FF6D3B4D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3140674995-0
                                                                                                                                                                                                                                          • Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                          • Instruction ID: a6ae263c734a39bcee53a6c4f0df8e4a4c069b7319012be0741a3f16866e6022
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8C316272A0AB8186EB60DF61E8413EE73B0FB95708F04403ADA8E97B95DF78D158C744
                                                                                                                                                                                                                                          Function 00007FF6D3B5A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1239891234-0
                                                                                                                                                                                                                                          • Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                          • Instruction ID: 2ac721f7b39c3bb915d6974a99856543f1d5238beba40c2239848304747f5da6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D531B432A09B8186DB60CF25E8412AEB7B4FB9A758F400136EACD97B95DF3CC155CB40
                                                                                                                                                                                                                                          Function 00007FF6D3B61874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2227656907-0
                                                                                                                                                                                                                                          • Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                          • Instruction ID: 15191ec77bb6875172c200fafe11f43109fa113942a51f9eab0696c579189478
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3FB1E922B1A69241EA61DB21D9021BDE350FB66BE4F446133DADDABBC6DF3CE451C340
                                                                                                                                                                                                                                          Function 00007FF6D3B4D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                                                          • Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                          • Instruction ID: c8d645bf0715212bee8c8fa2ea62ca705ccc2bb15b5c0053190f5a7c4438fead
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 71115122B15F0589EB00CF61E8562BD73B4FB2A758F040E36DA5D96764DF7CD1648780
                                                                                                                                                                                                                                          Function 00007FF6D3B63C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memcpy_s
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1502251526-0
                                                                                                                                                                                                                                          • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                          • Instruction ID: 314f0818b08b77975687794712bf8819171d816da7612f9889771a2c31061280
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 58C14772B1A68687D724CF19A04466EF791F7A5B84F008136DB8E9B785CF3DE811CB80
                                                                                                                                                                                                                                          Function 00007FF6D3B4A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                                          • API String ID: 0-1127688429
                                                                                                                                                                                                                                          • Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                          • Instruction ID: d665b4426caabdbc4c7b09a1d49f1bbd9bae2eaafafcdc57bf187abe4bc27a04
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37F1B572A1A3D54BE7E58F14C089B3EBBA9EF5A748F05413ADA89A7390CF38D450C744
                                                                                                                                                                                                                                          Function 00007FF6D3B69728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 15204871-0
                                                                                                                                                                                                                                          • Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                          • Instruction ID: 17c30385f789d11b33b7ae5809cc6e6285e4ec477610ec3b1e1cb0661dc74ec2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CAB15D73A05B898BEB19CF29C84636C7BE0F745B88F148922DA9D877A5CF39D461C740
                                                                                                                                                                                                                                          Function 00007FF6D3B539A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: $
                                                                                                                                                                                                                                          • API String ID: 0-227171996
                                                                                                                                                                                                                                          • Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                          • Instruction ID: 865d501af16f62b6aa463a98f0b6aa9535e558baf4115df922c09d15b28c6c99
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A0E1CA32A0A64685EB688F25C05223DB360FF66B48F145937DA8EA77D4DF3DE861C700
                                                                                                                                                                                                                                          Function 00007FF6D3B4A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                                          • API String ID: 0-900081337
                                                                                                                                                                                                                                          • Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                          • Instruction ID: 56c06167e420e40e6811177aefde3a9ae4bb2c9f7a6891de4a3f117c6c719792
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2891A472A192C687E7A4CB14C449B3EBBA9FB59358F11413ADACAD6780DF38E550CB04
                                                                                                                                                                                                                                          Function 00007FF6D3B5DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: e+000$gfff
                                                                                                                                                                                                                                          • API String ID: 0-3030954782
                                                                                                                                                                                                                                          • Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                          • Instruction ID: a9d1db78c70b30da50179bc1db9a2d5c1c317c32e3b01c32a0467d5f14dacdf8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A8516422B1A3C586E721CE35D8127BDAB91E766B94F4C8236CBD8DBAC1CE3DD0508700
                                                                                                                                                                                                                                          Function 00007FF6D3B5DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: gfffffff
                                                                                                                                                                                                                                          • API String ID: 0-1523873471
                                                                                                                                                                                                                                          • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                          • Instruction ID: 7002c404d63f3f2e895e46be65163d94292f6b5274440d94ae4c82998efc9822
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9DA14662A0A7C986EB21CF25E4017BEBB91AB66B84F048236DE8D97785DE3DD411C701
                                                                                                                                                                                                                                          Function 00007FF6D3B58794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: TMP
                                                                                                                                                                                                                                          • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                          • Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                          • Instruction ID: 161f8a48d2b6d1c28d61b654080a729927de814c79e793f712f4724281b888c8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EF519411F0AA1241FA54A627D91317ED290AF66BD4F885437DE8EF77D6EE3CE4228340
                                                                                                                                                                                                                                          Function 00007FF6D3B63480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: HeapProcess
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 54951025-0
                                                                                                                                                                                                                                          • Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                          • Instruction ID: 19a88af3d8f23cf481709d6433c26aebe7f9b44b8f750bd76259f047c6cc9004
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A5B09224E07A02C2EE086F22AC8321C62A47F69700F98013AC08DA4330DE2C20F55B40
                                                                                                                                                                                                                                          Function 00007FF6D3B535A0 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                          • Instruction ID: fcca2fdc8f62b27eeb76d0c74ff678f0014d567164bdb1349c0ac2e58fac6dcd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5D1D662A0E64245EB688E25C04277DA7A0EF26B48F140A3BCE8DA7795DF39D865C740
                                                                                                                                                                                                                                          Function 00007FF6D3B49800 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                          • Instruction ID: a39980067e16ba06e591d1b028f4890499d8bd37261ee4de1a2861048c91868b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EBC19E762181E08BD28AEB29E47947A73E1F78A34DB95406BEF87477C5CB3CA414DB10
                                                                                                                                                                                                                                          Function 00007FF6D3B52C10 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                          • Instruction ID: 8c37756be0848fbeb57b1272e398ccb8e65de86edf8a71f008645d42c1fb20ca
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 99B15E7290B78585E765CF39C05123CBBA0F76AB88F244136CA8EAB795CF39D461C744
                                                                                                                                                                                                                                          Function 00007FF6D3B5E570 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                          • Instruction ID: b08f9cb762111869678a20daba15eb4c2b9daccad347f8bbe05300a50de33b23
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2681C372A0978146E774CF19E4423BEAA91FB667D4F184236DADD97B89DF3CE4108B00
                                                                                                                                                                                                                                          Function 00007FF6D3B66418 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
                                                                                                                                                                                                                                          • Instruction ID: 4392576706d706b4930cf1f616756deb9d5633a9244e628ff61701583a2b37bb
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C611932E0E2524AF7648A28945377DE681AF73760F14023BD69DEB6D6DE7DE8108780
                                                                                                                                                                                                                                          Function 00007FF6D3B51944 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                          • Instruction ID: 670f481e8b5bf6d4f8a35cd1d66c0cc8871d7ff7606b7a14d35010922f57749f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B4519A36A1665185EB258F29C04163CB7A0EB66F58F245132CECDA7794DF3AEC63C740
                                                                                                                                                                                                                                          Function 00007FF6D3B52164 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                          • Instruction ID: cc9d6374beeeda4824a6e84609fac96ed4815633f88697b94d3c53e6cf19f144
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C51B936B1B65185E7248B29C44123D7760EB7AB98F244132CECDAB794CF3AE963C740
                                                                                                                                                                                                                                          Function 00007FF6D3B51D54 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                          • Instruction ID: 5bb1e34176b9b90f0fb7496a43f90675663ff887611a81d534c21ff30ad3bc7f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3751A936A1A65582EB248B29C04133C73A0EB66B58F245132CECDA77D5CF3AEC63C740
                                                                                                                                                                                                                                          Function 00007FF6D3B51B50 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                          • Instruction ID: 002ed88bbd682304799317678eb7e46c48d6e7132f3d9a7a3e3d8149da171874
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5519B36A1A65185EB258F29C04233C77A1EB56F58F246132CE8DA7794DF3AEC63C740
                                                                                                                                                                                                                                          Function 00007FF6D3B51740 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                          • Instruction ID: 214d5a0909f9dd9aab888defe3b6e26be37738f15af6394c5415f7fd7b1d458b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 17518676A1A65185EB348B29C04123CB7A1EB66F58F245132CE8DA7794DF3EE863C740
                                                                                                                                                                                                                                          Function 00007FF6D3B51F60 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                          • Instruction ID: 16d82061f0b3f1498360758ee2e85552801a68b1b9f5e96f8208bb1aba61cb9f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D051AC3771B65185E7248B19C04123D77A1EB66F98F285132CE8CA7795CF3AE863C740
                                                                                                                                                                                                                                          Function 00007FF6D3B55D30 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                          • Instruction ID: 003d5061e62b2475e3423e0a056f802a0d9390e38b68e530c54c55f5b6d5268e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B241966384F74E05E99989188509ABCA6809F337A2E5852B7DDDFB73D3CD0DE5A6C300
                                                                                                                                                                                                                                          Function 00007FF6D3B59EA0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                                                          • Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                          • Instruction ID: 4a21cc82207b3c00250c66d95bb66c8369bcca70bde69195408484800142dc78
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2341C062B15A5582EE44CF2AD91616DA3A1FB5AFD4B099033EE4DE7B54DE3CD0528300
                                                                                                                                                                                                                                          Function 00007FF6D3B580E4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
                                                                                                                                                                                                                                          • Instruction ID: 7f7a8e37f3d4d1653b080b2df0306d0ab93b44c2b6d7caba60bb58699c3ab20e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A731B632B0AF4141E7549F26A44213DBAD5AB96BD0F54423AEACDE7BD6DF3CD0218704
                                                                                                                                                                                                                                          Function 00007FF6D3B69570 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                          • Instruction ID: 3208190237195aaa97fb4e98c80801c69850080414ad757c55e7281491e4ce10
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 11F044717192968ADB988F69A40362977D0F718380F44803AD5CDC3B04DE3C91618F04
                                                                                                                                                                                                                                          Function 00007FF6D3B4D30C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                          • Instruction ID: f2329d2703e1ce369484051f3603752e8ad772e20bf5ea5d3e893e17932dd448
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C6A00121E0E80AD1E6448B01A892029A770BB6A304B80003AE08EA50A2EE6CA5249685
                                                                                                                                                                                                                                          Function 00007FF6D3B476C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                          • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                          • Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                          • Instruction ID: 190fecef224590d099aeb9953e3a96dcada948ffa2ce54731804f791073b5b02
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0D02B82090FF0791EA14DB56A81357CA365EF7A744F441037C8EEAA262EF7CB569C680
                                                                                                                                                                                                                                          Function 00007FF6D3B481D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B49390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D3B445F4,00000000,00007FF6D3B41985), ref: 00007FF6D3B493C9
                                                                                                                                                                                                                                          • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6D3B486B7,?,?,00000000,00007FF6D3B43CBB), ref: 00007FF6D3B4822C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42810: MessageBoxW.USER32 ref: 00007FF6D3B428EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                          • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                          • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                          • Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                          • Instruction ID: f6191546b841ebabff1b70a6f07e0efbe92e88e76ab831d2bccaa09b736e2f32
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6A51E911A1FA4240FA10DB25D8532BDE360EF7A788F444437E68EE66D6FE2CE5248744
                                                                                                                                                                                                                                          Function 00007FF6D3B42180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                          • String ID: P%
                                                                                                                                                                                                                                          • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                          • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction ID: fc1c65b06976659e4b286c2cc0acfd4a83698c36359d7529751de6fb8edd0664
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67511726604BA187D6249F22E4181BEF7A1F7A9B65F004132EBCE83695DF3CD055DB10
                                                                                                                                                                                                                                          Function 00007FF6D3B480C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                          • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                          • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                          • Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                          • Instruction ID: aa46d1b274e629ee257d64077777a0cfac235ad84beeaab1bbea465bc2cfc51d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DA21D821B0AE4282E7418B7BA84517DA360EFAEB94F484133DA9DD73D5DE6CD5A08600
                                                                                                                                                                                                                                          Function 00007FF6D3B56290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: -$:$f$p$p
                                                                                                                                                                                                                                          • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                          • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction ID: 721fae49de98b8ed2e9bdf7baeb8471508ca53cd42d0256e4d1ec101dc39a316
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0612B361E0E2438AFB606E14D1563BDF691FBB2750F845137E6C9A66C4DF3CE9A08B04
                                                                                                                                                                                                                                          Function 00007FF6D3B50FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: f$f$p$p$f
                                                                                                                                                                                                                                          • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                          • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                          • Instruction ID: 65e8d5eebab80e7b9e46db6f5ddaad0837af705d91ff1de9463882288eb2f521
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0012B662E0E14386FF209E14E05667DF6A1FBA2754F885033D6DA96AC4DF7CE5A0CB10
                                                                                                                                                                                                                                          Function 00007FF6D3B41050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: d887d44ea8411714a319a2ddb58e34d6532429a931d40157cb204db5ad1c3ab0
                                                                                                                                                                                                                                          • Instruction ID: 145385d352356e34713d859040889ab5466d130a1632819faa03963284b2e986
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d887d44ea8411714a319a2ddb58e34d6532429a931d40157cb204db5ad1c3ab0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D418521F0A65241EA10DB56A8026BDE390FF6ABC8F445433ED8DE7796DE3CE521C744
                                                                                                                                                                                                                                          Function 00007FF6D3B41470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: 04eae6a6e28014538c265d314aaf186d5e7ccf6377acaf4908732b6d0be74f73
                                                                                                                                                                                                                                          • Instruction ID: 7b8898447a1ec3f1d5adb5fe62c0306df338292b121af59da80dd8030463f668
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 04eae6a6e28014538c265d314aaf186d5e7ccf6377acaf4908732b6d0be74f73
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C7419522A0A64285EB00DB21D4025FDE3A0FF6A798F445433ED8DAB796DE7CE521CB44
                                                                                                                                                                                                                                          Function 00007FF6D3B4EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                          • String ID: csm$csm$csm
                                                                                                                                                                                                                                          • API String ID: 849930591-393685449
                                                                                                                                                                                                                                          • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                          • Instruction ID: b51cdbf63ef3b1dd83efa285be1b8a5b6e170b50f7df5e0ad8f42b87ed47050b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 70D19532A0A74586EB609F65D4823ADB7A0FB6A78CF140136DECDA7756CF38E460C704
                                                                                                                                                                                                                                          Function 00007FF6D3B5ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF6D3B5F0AA,?,?,00000178B86B6BE8,00007FF6D3B5AD53,?,?,?,00007FF6D3B5AC4A,?,?,?,00007FF6D3B55F3E), ref: 00007FF6D3B5EE8C
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF6D3B5F0AA,?,?,00000178B86B6BE8,00007FF6D3B5AD53,?,?,?,00007FF6D3B5AC4A,?,?,?,00007FF6D3B55F3E), ref: 00007FF6D3B5EE98
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                          • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                          • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                          • Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                          • Instruction ID: 42f3f8ba380fab859dbe48318c8919f6f7b9379fa7534b5ef7cf1ab8c81b8a7c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E41F761B2BA0641EA55CB16E8026BDA391BF6BB90F4C4137DD9DE7784DF3CE4258300
                                                                                                                                                                                                                                          Function 00007FF6D3B42C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D3B43706,?,00007FF6D3B43804), ref: 00007FF6D3B42C9E
                                                                                                                                                                                                                                          • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D3B43706,?,00007FF6D3B43804), ref: 00007FF6D3B42D63
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF6D3B42D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                          • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                          • Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                          • Instruction ID: 522ace0d331280abb20c811d4e9090384b68751aa7b7581cbc81dbd8d2495f50
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD31F822B09B5142E620DB65A8012BEA7A1BF99BC8F400137EF8DE7759DF3CD516C740
                                                                                                                                                                                                                                          Function 00007FF6D3B4DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DD4D
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DD5B
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DD85
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DDF3
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DDFF
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                          • String ID: api-ms-
                                                                                                                                                                                                                                          • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                          • Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                          • Instruction ID: 468997fbaaf68c28db69a6f4f24a634a4a2e1049a7e04f770c9a43da35da1aa4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F5310821B1BA01D1EE11DB02A40217DA3A4FF2EBA8F49013BDD9DAB386DF3CE0508304
                                                                                                                                                                                                                                          Function 00007FF6D3B46360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                          • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                          • Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                                                          • Instruction ID: 06a1d2ad1c2b4956f8f9dbec6d2865d1e2833496cc59fd52d488f61c0cafe38b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36419931A1A68791EA11DB10E4162FDA311FF6A388F404133DADDE7696EF3CE525C744
                                                                                                                                                                                                                                          Function 00007FF6D3B42A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6D3B4351A,?,00000000,00007FF6D3B43F23), ref: 00007FF6D3B42AA0
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                          • Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                          • Instruction ID: 7989635ab41fd95f7133954cb686a10942136cc23c0ba989f73c98f18af0667b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D219F32A1AB8152E620DB51F8427EAA3A4FB997C4F400132EECCA765ADF7CD2558740
                                                                                                                                                                                                                                          Function 00007FF6D3B5B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
                                                                                                                                                                                                                                          • Instruction ID: ca2d0fc41749a10e5d15e4c3691350fcf07420572b874d56b89b6932bfce04da
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB21D021F0F24281F595E721D65313DD6429F667F0F084636D8BEF7AC6DE6CA4214B00
                                                                                                                                                                                                                                          Function 00007FF6D3B67D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                          • String ID: CONOUT$
                                                                                                                                                                                                                                          • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                          • Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                          • Instruction ID: 9410660c881c9baabd4cdb5053c2cba7ca1fde8448a73df5d6bf797f014774ce
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9611D621B19B4182E3508B12E84632DB7A0FBA9BE4F040235D99EDB795CF7CD4248780
                                                                                                                                                                                                                                          Function 00007FF6D3B48ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B48EFD
                                                                                                                                                                                                                                          • K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B48F5A
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B49390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D3B445F4,00000000,00007FF6D3B41985), ref: 00007FF6D3B493C9
                                                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B48FE5
                                                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B49044
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B49055
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B4906A
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3462794448-0
                                                                                                                                                                                                                                          • Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                          • Instruction ID: 45a5577a98f946f7b1e25aa2da7c016f4a72fe09c5b22e96adb479d394c2431e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC41A961B1A68181EA309B12A5022BEB3A4FF9ABD8F440136DFCDE7789DE3DD510C704
                                                                                                                                                                                                                                          Function 00007FF6D3B5B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B2D7
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B30D
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B33A
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B34B
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B35C
                                                                                                                                                                                                                                          • SetLastError.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B377
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
                                                                                                                                                                                                                                          • Instruction ID: 477b99f7bdf5c71ae0f0387dbd7b8600e6447a162b99a6b546f6a5ee379e9ad7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9811A121F0F64282FA58E721D54313DE6529F767B0F084336D8AEF7AD6DEACA5214700
                                                                                                                                                                                                                                          Function 00007FF6D3B42910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6D3B41B6A), ref: 00007FF6D3B4295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                          • Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                          • Instruction ID: e7c40c75f2823b0f672a1ca52d58f1a1a78d63c6c51a78453977a0b320abc0ed
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 15312822B1A68152E7109761A8426FEA394BF9A7D8F400133EECDE7746EF7CD556C700
                                                                                                                                                                                                                                          Function 00007FF6D3B42390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                          • String ID: Unhandled exception in script
                                                                                                                                                                                                                                          • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                          • Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                          • Instruction ID: 1b5924075824b8b68a2852fc833fa3bc585d846707d577955116eacc3df32b12
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0531997261A68185EB20DF61E8561FDA360FF9A788F440136EA8D9BB49DF3CD111C740
                                                                                                                                                                                                                                          Function 00007FF6D3B42B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6D3B4918F,?,00007FF6D3B43C55), ref: 00007FF6D3B42BA0
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF6D3B42C2A
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                          • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                          • Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                          • Instruction ID: 4192ab8fe7c8db54048802c1304ebf6a0e6a2e5c1b5a4a21a5e21546e6dccd8c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E221D162B0AB4152E710DB55F8427AEB3A4FB99784F400136EA8DA775ADE3CD225C740
                                                                                                                                                                                                                                          Function 00007FF6D3B42710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6D3B41B99), ref: 00007FF6D3B42760
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                          • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                          • Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                          • Instruction ID: fb70a3b910aa856934e94e4aaf281a98830a0a45627bcaad1831bfa1dd9be5ff
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9121D132A0A78152E720DB51F8427EAA3A4FB993C4F400132EECCA765ADF7CD1558740
                                                                                                                                                                                                                                          Function 00007FF6D3B59A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                          • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                          • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                          • Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                          • Instruction ID: 180ad541187aa13c6bf12124995d716a8112acd3a3176dd6ba91158c138ac6c9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 27F0C861B0AB0681EB108B11E44673DA330EF9A7A0F440237C9AE991E4DF6CD054C750
                                                                                                                                                                                                                                          Function 00007FF6D3B69368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _set_statfp
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1156100317-0
                                                                                                                                                                                                                                          • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction ID: 3d7f22b9e0394a92e499baaeb76e5e433ef05fbeb75d39c8d8c181e7fbda2f0d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5C118672D5EA0341FA641155E49337DB050AFBB370E040636EBEEFE2DBCE6C66614180
                                                                                                                                                                                                                                          Function 00007FF6D3B5B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FlsGetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B3AF
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B3CE
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B3F6
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B407
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B418
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
                                                                                                                                                                                                                                          • Instruction ID: 0657d732bb32510ab97403e85e6999864a4037da08c765abbc5e8911bf6b0ad6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0011A221F0B64281F964E725D54317DE2419FA27B0F4C4336D8BDF6AC6DE6CE4624700
                                                                                                                                                                                                                                          Function 00007FF6D3B5B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
                                                                                                                                                                                                                                          • Instruction ID: fb5ee699dec7fb1acecc7a14ec969ac4050e5f227d434a26c9266f5acc1c77f5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC115A21E0B20781F999E661C41317DDA424F67330F0C4736D9BEFAAC2DD6DB4214B61
                                                                                                                                                                                                                                          Function 00007FF6D3B55FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: verbose
                                                                                                                                                                                                                                          • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                          • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction ID: 906b16ef87af5c4b245fa1e510a02e9b76ee39ec18552b0cb39b23cd7c0e1752
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8D913532B0A64689F7618E24D45237DB7A0AB62B94F486133DADDE33C5DF3DE8658300
                                                                                                                                                                                                                                          Function 00007FF6D3B5FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                          • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                          • Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                          • Instruction ID: c4330fc6d580fcf948131b2ab3ce6ff99c85d6b7f2b25a04cbd6b8657a3982d4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3819F73E0A246C5F7A55E29C20227CFEA0EB33B44F554037CA89F7AC5CE2DA8218701
                                                                                                                                                                                                                                          Function 00007FF6D3B4D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                          • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                          • Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                          • Instruction ID: a7096737d91810107e77bc91bd19d7b6fa52de67c2c04e653d40dc686263db76
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC51B032B1B6028ADB14CB15D145A3CB391EB69B9CF10813ADA8E97746DF7CE861C704
                                                                                                                                                                                                                                          Function 00007FF6D3B4F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm$csm
                                                                                                                                                                                                                                          • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                          • Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                          • Instruction ID: 8538ae5273ab2010acce74533ac338cf77ba398a8a5929a517cd60b463c1442c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5951863360924286EB748B65A04526CBBA0FB6AB98F144137DACD97B85CF3CE560C705
                                                                                                                                                                                                                                          Function 00007FF6D3B4EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                          • String ID: MOC$RCC
                                                                                                                                                                                                                                          • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                          • Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                          • Instruction ID: 9d4ace282c94e2b59cf74974ccd4ffd24cb06562bc5dc57a08255ab89a9a92dc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 68618233909BC585E7618B15E4413AEBBA0FB99798F044226EBDC53B55CF7CD1A0CB04
                                                                                                                                                                                                                                          Function 00007FF6D3B42810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message
                                                                                                                                                                                                                                          • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                          • Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                          • Instruction ID: 472a5cf3cbeb8722649ae4b781667aeab79773fcdfe7806e5842a47b0e46b10b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4021BF62B09B4192E710DB55F4427AEB3A0EB99784F400136EA8DA765ADE3CD265C740
                                                                                                                                                                                                                                          Function 00007FF6D3B5C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2718003287-0
                                                                                                                                                                                                                                          • Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                          • Instruction ID: 007295f1b2d19932f5c0172be5dc47b96591032668fe59c72c2293b41202fcb3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 16D11672B0AA4189E711CF65D4412BCB7B2FB66798B044236DE8DE7B89DF38D026C700
                                                                                                                                                                                                                                          Function 00007FF6D3B420C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1956198572-0
                                                                                                                                                                                                                                          • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction ID: 852095eb79b5456f0ceda9b8043c8bef7a658c76be520df6af63f4ca1bfd4d68
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F9110C21F0D14242F654C7AAE54627D93A1EFEE7C4F448032DBC99BB8ACD7DD4E19604
                                                                                                                                                                                                                                          Function 00007FF6D3B65B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: ?
                                                                                                                                                                                                                                          • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                          • Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                          • Instruction ID: 513fa44ea400b37ebce002300013dfad9ff59daba7d07b185637c50e010441c9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C1411B12A0A38246FB609B25D54237DE750EBA2BA4F144237EFDC9AAD6DF3CD4718740
                                                                                                                                                                                                                                          Function 00007FF6D3B59014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B59046
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A95E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: GetLastError.KERNEL32(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A968
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6D3B4CBA5), ref: 00007FF6D3B59064
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                          • API String ID: 3580290477-1542176811
                                                                                                                                                                                                                                          • Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                          • Instruction ID: 06d8af59019e30d77279e2371079e0de1a2ca4e0df646733bd88af7732c5ff45
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1341B136A0AB1285EB55EF25D4420BCB7A4EF667D0B454037E98EE7B85DF3CE4A18300
                                                                                                                                                                                                                                          Function 00007FF6D3B5CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                          • String ID: U
                                                                                                                                                                                                                                          • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                          • Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                          • Instruction ID: 3448119a604d8277742232b120e6445e4919e1a627a9d14c9be17b46a83395a7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EE41B322B1AA4181DB208F25E4453BDA7A1FBAAB84F544132EE8DD7798EF7CD451C740
                                                                                                                                                                                                                                          Function 00007FF6D3B5F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentDirectory
                                                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                                                          • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                          • Opcode ID: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
                                                                                                                                                                                                                                          • Instruction ID: 81003fbb3fcfd73f5379e9ff3191e50ee50b43c79208ade86fe2f4345979bc8a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 16210663A0A64181EB20DB11D04627DF7B1FBAAB44F454036D6CDA3684CF7CD955CB41
                                                                                                                                                                                                                                          Function 00007FF6D3B4FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                          • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                          • Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                          • Instruction ID: dc58035478c4e49ae7882edd81da0f586827acb2767b234dd6805746686697e8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 12114C32609B8182EB218F15E40025EBBE4FB99B88F184231DACD57765DF3CC561CB40
                                                                                                                                                                                                                                          Function 00007FF6D3B6073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3684997634.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3684914666.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685083714.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685163644.00007FF6D3B82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3685276199.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                                                          • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                          • Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                          • Instruction ID: fb2e656530deb4e387ae7583ebf220f36d3d68b5385d8c9440f3df77e1cc15b4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B301A76291D20386F7219F61946327EB3A0EF6B744F840037D5CDE6686DF3CD5248B54

                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                          Execution Coverage:4%
                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                          Signature Coverage:0.3%
                                                                                                                                                                                                                                          Total number of Nodes:781
                                                                                                                                                                                                                                          Total number of Limit Nodes:29
                                                                                                                                                                                                                                          execution_graph 27370 7ffdfa830180 GetSystemInfo 27371 7ffdfa8301b4 27370->27371 27372 7ff6d3b4cc3c 27393 7ff6d3b4ce0c 27372->27393 27375 7ff6d3b4cd88 27544 7ff6d3b4d12c 7 API calls 2 library calls 27375->27544 27376 7ff6d3b4cc58 __scrt_acquire_startup_lock 27378 7ff6d3b4cd92 27376->27378 27385 7ff6d3b4cc76 __scrt_release_startup_lock 27376->27385 27545 7ff6d3b4d12c 7 API calls 2 library calls 27378->27545 27380 7ff6d3b4cc9b 27381 7ff6d3b4cd9d __GetCurrentState 27382 7ff6d3b4cd21 27399 7ff6d3b4d274 27382->27399 27384 7ff6d3b4cd26 27402 7ff6d3b41000 27384->27402 27385->27380 27385->27382 27541 7ff6d3b59b2c 45 API calls 27385->27541 27390 7ff6d3b4cd49 27390->27381 27543 7ff6d3b4cf90 7 API calls 27390->27543 27392 7ff6d3b4cd60 27392->27380 27394 7ff6d3b4ce14 27393->27394 27395 7ff6d3b4ce20 __scrt_dllmain_crt_thread_attach 27394->27395 27396 7ff6d3b4ce2d 27395->27396 27397 7ff6d3b4cc50 27395->27397 27396->27397 27546 7ff6d3b4d888 7 API calls 2 library calls 27396->27546 27397->27375 27397->27376 27547 7ff6d3b6a4d0 27399->27547 27403 7ff6d3b41009 27402->27403 27549 7ff6d3b55484 27403->27549 27405 7ff6d3b437fb 27556 7ff6d3b436b0 27405->27556 27411 7ff6d3b4383c 27655 7ff6d3b41c80 27411->27655 27412 7ff6d3b4391b 27660 7ff6d3b445c0 27412->27660 27416 7ff6d3b4385b 27628 7ff6d3b48830 27416->27628 27419 7ff6d3b4396a 27683 7ff6d3b42710 54 API calls _log10_special 27419->27683 27421 7ff6d3b4388e 27429 7ff6d3b438bb __std_exception_destroy 27421->27429 27659 7ff6d3b489a0 40 API calls __std_exception_destroy 27421->27659 27423 7ff6d3b4395d 27424 7ff6d3b43984 27423->27424 27425 7ff6d3b43962 27423->27425 27427 7ff6d3b41c80 49 API calls 27424->27427 27679 7ff6d3b5004c 27425->27679 27430 7ff6d3b439a3 27427->27430 27431 7ff6d3b48830 14 API calls 27429->27431 27438 7ff6d3b438de __std_exception_destroy 27429->27438 27435 7ff6d3b41950 115 API calls 27430->27435 27431->27438 27433 7ff6d3b43a0b 27686 7ff6d3b489a0 40 API calls __std_exception_destroy 27433->27686 27437 7ff6d3b439ce 27435->27437 27436 7ff6d3b43a17 27687 7ff6d3b489a0 40 API calls __std_exception_destroy 27436->27687 27437->27416 27440 7ff6d3b439de 27437->27440 27444 7ff6d3b4390e __std_exception_destroy 27438->27444 27685 7ff6d3b48940 40 API calls __std_exception_destroy 27438->27685 27684 7ff6d3b42710 54 API calls _log10_special 27440->27684 27441 7ff6d3b43a23 27688 7ff6d3b489a0 40 API calls __std_exception_destroy 27441->27688 27445 7ff6d3b48830 14 API calls 27444->27445 27446 7ff6d3b43a3b 27445->27446 27447 7ff6d3b43b2f 27446->27447 27448 7ff6d3b43a60 __std_exception_destroy 27446->27448 27690 7ff6d3b42710 54 API calls _log10_special 27447->27690 27461 7ff6d3b43aab 27448->27461 27689 7ff6d3b48940 40 API calls __std_exception_destroy 27448->27689 27451 7ff6d3b48830 14 API calls 27452 7ff6d3b43bf4 __std_exception_destroy 27451->27452 27453 7ff6d3b43c46 27452->27453 27454 7ff6d3b43d41 27452->27454 27455 7ff6d3b43c50 27453->27455 27456 7ff6d3b43cd4 27453->27456 27704 7ff6d3b444e0 49 API calls 27454->27704 27691 7ff6d3b490e0 59 API calls _log10_special 27455->27691 27459 7ff6d3b48830 14 API calls 27456->27459 27463 7ff6d3b43ce0 27459->27463 27460 7ff6d3b43d4f 27464 7ff6d3b43d71 27460->27464 27465 7ff6d3b43d65 27460->27465 27461->27451 27462 7ff6d3b43c55 27466 7ff6d3b43c61 27462->27466 27467 7ff6d3b43cb3 27462->27467 27463->27466 27470 7ff6d3b43ced 27463->27470 27469 7ff6d3b41c80 49 API calls 27464->27469 27705 7ff6d3b44630 27465->27705 27692 7ff6d3b42710 54 API calls _log10_special 27466->27692 27702 7ff6d3b48660 86 API calls 2 library calls 27467->27702 27481 7ff6d3b43d2b __std_exception_destroy 27469->27481 27474 7ff6d3b41c80 49 API calls 27470->27474 27472 7ff6d3b43cbb 27477 7ff6d3b43cc8 27472->27477 27478 7ff6d3b43cbf 27472->27478 27479 7ff6d3b43d0b 27474->27479 27475 7ff6d3b43dc4 27641 7ff6d3b49390 27475->27641 27477->27481 27478->27466 27479->27481 27482 7ff6d3b43d12 27479->27482 27480 7ff6d3b43dd7 SetDllDirectoryW 27486 7ff6d3b43e0a 27480->27486 27487 7ff6d3b43e5a 27480->27487 27481->27475 27483 7ff6d3b43da7 SetDllDirectoryW LoadLibraryExW 27481->27483 27703 7ff6d3b42710 54 API calls _log10_special 27482->27703 27483->27475 27490 7ff6d3b48830 14 API calls 27486->27490 27489 7ff6d3b44008 27487->27489 27491 7ff6d3b43f1b 27487->27491 27488 7ff6d3b43808 __std_exception_destroy 27693 7ff6d3b4c550 27488->27693 27492 7ff6d3b44035 27489->27492 27493 7ff6d3b44012 PostMessageW GetMessageW 27489->27493 27498 7ff6d3b43e16 __std_exception_destroy 27490->27498 27716 7ff6d3b433c0 121 API calls 2 library calls 27491->27716 27646 7ff6d3b43360 27492->27646 27493->27492 27495 7ff6d3b43f23 27495->27488 27496 7ff6d3b43f2b 27495->27496 27717 7ff6d3b490c0 LocalFree 27496->27717 27501 7ff6d3b43ef2 27498->27501 27505 7ff6d3b43e4e 27498->27505 27715 7ff6d3b48940 40 API calls __std_exception_destroy 27501->27715 27505->27487 27708 7ff6d3b46dc0 54 API calls _set_fmode 27505->27708 27508 7ff6d3b4404f 27719 7ff6d3b46fc0 FreeLibrary 27508->27719 27513 7ff6d3b4405b 27514 7ff6d3b43e6c 27709 7ff6d3b47340 117 API calls 2 library calls 27514->27709 27518 7ff6d3b43e81 27526 7ff6d3b43ea2 27518->27526 27532 7ff6d3b43e85 27518->27532 27710 7ff6d3b46e00 120 API calls _log10_special 27518->27710 27525 7ff6d3b43ee0 27714 7ff6d3b46fc0 FreeLibrary 27525->27714 27526->27532 27711 7ff6d3b471b0 125 API calls 27526->27711 27527 7ff6d3b43eb7 27527->27532 27712 7ff6d3b474f0 55 API calls 27527->27712 27532->27487 27713 7ff6d3b42a50 54 API calls _log10_special 27532->27713 27541->27382 27542 7ff6d3b4d2b8 GetModuleHandleW 27542->27390 27543->27392 27544->27378 27545->27381 27546->27397 27548 7ff6d3b4d28b GetStartupInfoW 27547->27548 27548->27384 27551 7ff6d3b5f480 27549->27551 27550 7ff6d3b5f4d3 27720 7ff6d3b5a814 37 API calls 2 library calls 27550->27720 27551->27550 27553 7ff6d3b5f526 27551->27553 27721 7ff6d3b5f358 71 API calls _fread_nolock 27553->27721 27554 7ff6d3b5f4fc 27554->27405 27722 7ff6d3b4c850 27556->27722 27559 7ff6d3b436eb GetLastError 27729 7ff6d3b42c50 51 API calls _log10_special 27559->27729 27560 7ff6d3b43710 27724 7ff6d3b49280 FindFirstFileExW 27560->27724 27564 7ff6d3b4377d 27732 7ff6d3b49440 WideCharToMultiByte WideCharToMultiByte __std_exception_destroy 27564->27732 27565 7ff6d3b43723 27730 7ff6d3b49300 CreateFileW GetFinalPathNameByHandleW CloseHandle 27565->27730 27566 7ff6d3b4c550 _log10_special 8 API calls 27570 7ff6d3b437b5 27566->27570 27569 7ff6d3b4378b 27576 7ff6d3b43706 27569->27576 27733 7ff6d3b42810 49 API calls _log10_special 27569->27733 27570->27488 27578 7ff6d3b41950 27570->27578 27571 7ff6d3b43730 27572 7ff6d3b43734 27571->27572 27575 7ff6d3b4374c __vcrt_FlsAlloc 27571->27575 27731 7ff6d3b42810 49 API calls _log10_special 27572->27731 27575->27564 27576->27566 27577 7ff6d3b43745 27577->27576 27579 7ff6d3b445c0 108 API calls 27578->27579 27580 7ff6d3b41985 27579->27580 27581 7ff6d3b41c43 27580->27581 27582 7ff6d3b47f90 83 API calls 27580->27582 27583 7ff6d3b4c550 _log10_special 8 API calls 27581->27583 27584 7ff6d3b419cb 27582->27584 27585 7ff6d3b41c5e 27583->27585 27627 7ff6d3b41a03 27584->27627 27734 7ff6d3b506d4 27584->27734 27585->27411 27585->27412 27587 7ff6d3b5004c 74 API calls 27587->27581 27588 7ff6d3b419e5 27589 7ff6d3b419e9 27588->27589 27590 7ff6d3b41a08 27588->27590 27741 7ff6d3b54f08 11 API calls _set_fmode 27589->27741 27738 7ff6d3b5039c 27590->27738 27594 7ff6d3b419ee 27742 7ff6d3b42910 54 API calls _log10_special 27594->27742 27595 7ff6d3b41a26 27743 7ff6d3b54f08 11 API calls _set_fmode 27595->27743 27596 7ff6d3b41a45 27601 7ff6d3b41a5c 27596->27601 27602 7ff6d3b41a7b 27596->27602 27599 7ff6d3b41a2b 27744 7ff6d3b42910 54 API calls _log10_special 27599->27744 27745 7ff6d3b54f08 11 API calls _set_fmode 27601->27745 27604 7ff6d3b41c80 49 API calls 27602->27604 27605 7ff6d3b41a92 27604->27605 27607 7ff6d3b41c80 49 API calls 27605->27607 27606 7ff6d3b41a61 27746 7ff6d3b42910 54 API calls _log10_special 27606->27746 27609 7ff6d3b41add 27607->27609 27610 7ff6d3b506d4 73 API calls 27609->27610 27611 7ff6d3b41b01 27610->27611 27612 7ff6d3b41b16 27611->27612 27613 7ff6d3b41b35 27611->27613 27747 7ff6d3b54f08 11 API calls _set_fmode 27612->27747 27615 7ff6d3b5039c _fread_nolock 53 API calls 27613->27615 27617 7ff6d3b41b4a 27615->27617 27616 7ff6d3b41b1b 27748 7ff6d3b42910 54 API calls _log10_special 27616->27748 27619 7ff6d3b41b50 27617->27619 27620 7ff6d3b41b6f 27617->27620 27749 7ff6d3b54f08 11 API calls _set_fmode 27619->27749 27751 7ff6d3b50110 37 API calls 2 library calls 27620->27751 27623 7ff6d3b41b55 27750 7ff6d3b42910 54 API calls _log10_special 27623->27750 27624 7ff6d3b41b89 27624->27627 27752 7ff6d3b42710 54 API calls _log10_special 27624->27752 27627->27587 27629 7ff6d3b4883a 27628->27629 27630 7ff6d3b49390 2 API calls 27629->27630 27631 7ff6d3b48859 GetEnvironmentVariableW 27630->27631 27632 7ff6d3b48876 ExpandEnvironmentStringsW 27631->27632 27633 7ff6d3b488c2 27631->27633 27632->27633 27635 7ff6d3b48898 27632->27635 27634 7ff6d3b4c550 _log10_special 8 API calls 27633->27634 27636 7ff6d3b488d4 27634->27636 27782 7ff6d3b49440 WideCharToMultiByte WideCharToMultiByte __std_exception_destroy 27635->27782 27636->27421 27638 7ff6d3b488aa 27639 7ff6d3b4c550 _log10_special 8 API calls 27638->27639 27640 7ff6d3b488ba 27639->27640 27640->27421 27642 7ff6d3b493b2 MultiByteToWideChar 27641->27642 27643 7ff6d3b493d6 27641->27643 27642->27643 27645 7ff6d3b493ec __std_exception_destroy 27642->27645 27644 7ff6d3b493f3 MultiByteToWideChar 27643->27644 27643->27645 27644->27645 27645->27480 27783 7ff6d3b46360 27646->27783 27649 7ff6d3b43399 27718 7ff6d3b43670 FreeLibrary 27649->27718 27651 7ff6d3b43381 27651->27649 27851 7ff6d3b46050 27651->27851 27653 7ff6d3b4338d 27653->27649 27860 7ff6d3b461e0 54 API calls 27653->27860 27656 7ff6d3b41ca5 27655->27656 27999 7ff6d3b54984 27656->27999 27659->27429 27661 7ff6d3b445cc 27660->27661 27662 7ff6d3b49390 2 API calls 27661->27662 27663 7ff6d3b445f4 27662->27663 27664 7ff6d3b49390 2 API calls 27663->27664 27665 7ff6d3b44607 27664->27665 28026 7ff6d3b55f94 27665->28026 27668 7ff6d3b4c550 _log10_special 8 API calls 27669 7ff6d3b4392b 27668->27669 27669->27419 27670 7ff6d3b47f90 27669->27670 27671 7ff6d3b47fb4 27670->27671 27672 7ff6d3b506d4 73 API calls 27671->27672 27677 7ff6d3b4808b __std_exception_destroy 27671->27677 27673 7ff6d3b47fd0 27672->27673 27673->27677 28197 7ff6d3b578c8 27673->28197 27675 7ff6d3b506d4 73 API calls 27678 7ff6d3b47fe5 27675->27678 27676 7ff6d3b5039c _fread_nolock 53 API calls 27676->27678 27677->27423 27678->27675 27678->27676 27678->27677 27680 7ff6d3b5007c 27679->27680 28213 7ff6d3b4fe28 27680->28213 27682 7ff6d3b50095 27682->27419 27683->27488 27684->27488 27685->27433 27686->27436 27687->27441 27688->27444 27689->27461 27690->27488 27691->27462 27692->27488 27694 7ff6d3b4c559 27693->27694 27695 7ff6d3b43ca7 27694->27695 27696 7ff6d3b4c8e0 IsProcessorFeaturePresent 27694->27696 27695->27542 27697 7ff6d3b4c8f8 27696->27697 28225 7ff6d3b4cad8 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 27697->28225 27699 7ff6d3b4c90b 28226 7ff6d3b4c8a0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 27699->28226 27702->27472 27703->27488 27704->27460 27706 7ff6d3b41c80 49 API calls 27705->27706 27707 7ff6d3b44660 27706->27707 27707->27481 27707->27707 27708->27514 27709->27518 27710->27526 27711->27527 27712->27532 27713->27525 27714->27487 27715->27487 27716->27495 27718->27508 27719->27513 27720->27554 27721->27554 27723 7ff6d3b436bc GetModuleFileNameW 27722->27723 27723->27559 27723->27560 27725 7ff6d3b492bf FindClose 27724->27725 27726 7ff6d3b492d2 27724->27726 27725->27726 27727 7ff6d3b4c550 _log10_special 8 API calls 27726->27727 27728 7ff6d3b4371a 27727->27728 27728->27564 27728->27565 27729->27576 27730->27571 27731->27577 27732->27569 27733->27576 27735 7ff6d3b50704 27734->27735 27753 7ff6d3b50464 27735->27753 27737 7ff6d3b5071d 27737->27588 27766 7ff6d3b503bc 27738->27766 27741->27594 27742->27627 27743->27599 27744->27627 27745->27606 27746->27627 27747->27616 27748->27627 27749->27623 27750->27627 27751->27624 27752->27627 27754 7ff6d3b504ce 27753->27754 27755 7ff6d3b5048e 27753->27755 27754->27755 27756 7ff6d3b504da 27754->27756 27765 7ff6d3b5a814 37 API calls 2 library calls 27755->27765 27764 7ff6d3b5546c EnterCriticalSection 27756->27764 27759 7ff6d3b504df 27760 7ff6d3b505e8 71 API calls 27759->27760 27761 7ff6d3b504f1 27760->27761 27762 7ff6d3b55478 _fread_nolock LeaveCriticalSection 27761->27762 27763 7ff6d3b504b5 27762->27763 27763->27737 27765->27763 27767 7ff6d3b503e6 27766->27767 27778 7ff6d3b41a20 27766->27778 27768 7ff6d3b50432 27767->27768 27769 7ff6d3b503f5 memcpy_s 27767->27769 27767->27778 27779 7ff6d3b5546c EnterCriticalSection 27768->27779 27780 7ff6d3b54f08 11 API calls _set_fmode 27769->27780 27772 7ff6d3b5043a 27774 7ff6d3b5013c _fread_nolock 51 API calls 27772->27774 27773 7ff6d3b5040a 27781 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 27773->27781 27776 7ff6d3b50451 27774->27776 27777 7ff6d3b55478 _fread_nolock LeaveCriticalSection 27776->27777 27777->27778 27778->27595 27778->27596 27780->27773 27781->27778 27782->27638 27784 7ff6d3b46375 27783->27784 27785 7ff6d3b41c80 49 API calls 27784->27785 27786 7ff6d3b463b1 27785->27786 27787 7ff6d3b463dd 27786->27787 27788 7ff6d3b463ba 27786->27788 27790 7ff6d3b44630 49 API calls 27787->27790 27871 7ff6d3b42710 54 API calls _log10_special 27788->27871 27791 7ff6d3b463f5 27790->27791 27792 7ff6d3b46413 27791->27792 27872 7ff6d3b42710 54 API calls _log10_special 27791->27872 27861 7ff6d3b44560 27792->27861 27795 7ff6d3b4c550 _log10_special 8 API calls 27796 7ff6d3b4336e 27795->27796 27796->27649 27814 7ff6d3b46500 27796->27814 27798 7ff6d3b4642b 27800 7ff6d3b44630 49 API calls 27798->27800 27801 7ff6d3b46444 27800->27801 27802 7ff6d3b46469 27801->27802 27803 7ff6d3b46449 27801->27803 27805 7ff6d3b48e80 3 API calls 27802->27805 27873 7ff6d3b42710 54 API calls _log10_special 27803->27873 27806 7ff6d3b46476 27805->27806 27807 7ff6d3b464c1 27806->27807 27808 7ff6d3b46482 27806->27808 27875 7ff6d3b45830 137 API calls 27807->27875 27809 7ff6d3b49390 2 API calls 27808->27809 27811 7ff6d3b4649a GetLastError 27809->27811 27874 7ff6d3b42c50 51 API calls _log10_special 27811->27874 27813 7ff6d3b463d3 27813->27795 27876 7ff6d3b45400 27814->27876 27816 7ff6d3b46526 27817 7ff6d3b4653f 27816->27817 27818 7ff6d3b4652e 27816->27818 27883 7ff6d3b44c90 27817->27883 27901 7ff6d3b42710 54 API calls _log10_special 27818->27901 27822 7ff6d3b4654b 27902 7ff6d3b42710 54 API calls _log10_special 27822->27902 27824 7ff6d3b4655c 27825 7ff6d3b4656c 27824->27825 27828 7ff6d3b4657d 27824->27828 27903 7ff6d3b42710 54 API calls _log10_special 27825->27903 27826 7ff6d3b4653a 27826->27651 27829 7ff6d3b465ad 27828->27829 27830 7ff6d3b4659c 27828->27830 27832 7ff6d3b465cd 27829->27832 27833 7ff6d3b465bc 27829->27833 27904 7ff6d3b42710 54 API calls _log10_special 27830->27904 27887 7ff6d3b44d50 27832->27887 27905 7ff6d3b42710 54 API calls _log10_special 27833->27905 27837 7ff6d3b465ed 27840 7ff6d3b4660d 27837->27840 27841 7ff6d3b465fc 27837->27841 27838 7ff6d3b465dc 27906 7ff6d3b42710 54 API calls _log10_special 27838->27906 27843 7ff6d3b4661f 27840->27843 27845 7ff6d3b46630 27840->27845 27907 7ff6d3b42710 54 API calls _log10_special 27841->27907 27908 7ff6d3b42710 54 API calls _log10_special 27843->27908 27848 7ff6d3b4665a 27845->27848 27909 7ff6d3b572b0 73 API calls 27845->27909 27847 7ff6d3b46648 27910 7ff6d3b572b0 73 API calls 27847->27910 27848->27826 27911 7ff6d3b42710 54 API calls _log10_special 27848->27911 27852 7ff6d3b46070 27851->27852 27852->27852 27853 7ff6d3b46099 27852->27853 27859 7ff6d3b460b0 __std_exception_destroy 27852->27859 27943 7ff6d3b42710 54 API calls _log10_special 27853->27943 27855 7ff6d3b460a5 27855->27653 27856 7ff6d3b461bb 27856->27653 27858 7ff6d3b42710 54 API calls 27858->27859 27859->27856 27859->27858 27913 7ff6d3b41470 27859->27913 27860->27649 27862 7ff6d3b4456a 27861->27862 27863 7ff6d3b49390 2 API calls 27862->27863 27864 7ff6d3b4458f 27863->27864 27865 7ff6d3b4c550 _log10_special 8 API calls 27864->27865 27866 7ff6d3b445b7 27865->27866 27866->27798 27867 7ff6d3b48e80 27866->27867 27868 7ff6d3b49390 2 API calls 27867->27868 27869 7ff6d3b48e94 LoadLibraryExW 27868->27869 27870 7ff6d3b48eb3 __std_exception_destroy 27869->27870 27870->27798 27871->27813 27872->27792 27873->27813 27874->27813 27875->27813 27878 7ff6d3b4542c 27876->27878 27877 7ff6d3b45434 27877->27816 27878->27877 27881 7ff6d3b455d4 27878->27881 27912 7ff6d3b56aa4 48 API calls 27878->27912 27879 7ff6d3b45797 __std_exception_destroy 27879->27816 27880 7ff6d3b447d0 47 API calls 27880->27881 27881->27879 27881->27880 27884 7ff6d3b44cc0 27883->27884 27885 7ff6d3b4c550 _log10_special 8 API calls 27884->27885 27886 7ff6d3b44d2a 27885->27886 27886->27822 27886->27824 27888 7ff6d3b44d65 27887->27888 27889 7ff6d3b41c80 49 API calls 27888->27889 27890 7ff6d3b44db1 27889->27890 27891 7ff6d3b41c80 49 API calls 27890->27891 27900 7ff6d3b44e33 __std_exception_destroy 27890->27900 27893 7ff6d3b44df0 27891->27893 27892 7ff6d3b4c550 _log10_special 8 API calls 27894 7ff6d3b44e7e 27892->27894 27895 7ff6d3b49390 2 API calls 27893->27895 27893->27900 27894->27837 27894->27838 27896 7ff6d3b44e06 27895->27896 27897 7ff6d3b49390 2 API calls 27896->27897 27898 7ff6d3b44e1d 27897->27898 27899 7ff6d3b49390 2 API calls 27898->27899 27899->27900 27900->27892 27901->27826 27902->27826 27903->27826 27904->27826 27905->27826 27906->27826 27907->27826 27908->27826 27909->27847 27910->27848 27911->27826 27912->27878 27914 7ff6d3b445c0 108 API calls 27913->27914 27915 7ff6d3b41493 27914->27915 27916 7ff6d3b414bc 27915->27916 27917 7ff6d3b4149b 27915->27917 27919 7ff6d3b506d4 73 API calls 27916->27919 27966 7ff6d3b42710 54 API calls _log10_special 27917->27966 27921 7ff6d3b414d1 27919->27921 27920 7ff6d3b414ab 27920->27859 27922 7ff6d3b414f8 27921->27922 27923 7ff6d3b414d5 27921->27923 27926 7ff6d3b41508 27922->27926 27927 7ff6d3b41532 27922->27927 27967 7ff6d3b54f08 11 API calls _set_fmode 27923->27967 27925 7ff6d3b414da 27968 7ff6d3b42910 54 API calls _log10_special 27925->27968 27969 7ff6d3b54f08 11 API calls _set_fmode 27926->27969 27930 7ff6d3b41538 27927->27930 27938 7ff6d3b4154b 27927->27938 27944 7ff6d3b41210 27930->27944 27931 7ff6d3b41510 27970 7ff6d3b42910 54 API calls _log10_special 27931->27970 27934 7ff6d3b5004c 74 API calls 27936 7ff6d3b415c4 27934->27936 27935 7ff6d3b414f3 __std_exception_destroy 27935->27934 27936->27859 27937 7ff6d3b5039c _fread_nolock 53 API calls 27937->27938 27938->27935 27938->27937 27939 7ff6d3b415d6 27938->27939 27971 7ff6d3b54f08 11 API calls _set_fmode 27939->27971 27941 7ff6d3b415db 27972 7ff6d3b42910 54 API calls _log10_special 27941->27972 27943->27855 27945 7ff6d3b41268 27944->27945 27946 7ff6d3b4126f 27945->27946 27948 7ff6d3b41297 27945->27948 27977 7ff6d3b42710 54 API calls _log10_special 27946->27977 27950 7ff6d3b412b1 27948->27950 27951 7ff6d3b412d4 27948->27951 27949 7ff6d3b41282 27949->27935 27978 7ff6d3b54f08 11 API calls _set_fmode 27950->27978 27955 7ff6d3b412e6 27951->27955 27964 7ff6d3b41309 memcpy_s 27951->27964 27953 7ff6d3b412b6 27979 7ff6d3b42910 54 API calls _log10_special 27953->27979 27980 7ff6d3b54f08 11 API calls _set_fmode 27955->27980 27957 7ff6d3b5039c _fread_nolock 53 API calls 27957->27964 27958 7ff6d3b412eb 27981 7ff6d3b42910 54 API calls _log10_special 27958->27981 27960 7ff6d3b412cf __std_exception_destroy 27960->27935 27961 7ff6d3b413cf 27982 7ff6d3b42710 54 API calls _log10_special 27961->27982 27964->27957 27964->27960 27964->27961 27965 7ff6d3b50110 37 API calls 27964->27965 27973 7ff6d3b50adc 27964->27973 27965->27964 27966->27920 27967->27925 27968->27935 27969->27931 27970->27935 27971->27941 27972->27935 27974 7ff6d3b50b0c 27973->27974 27983 7ff6d3b5082c 27974->27983 27976 7ff6d3b50b2a 27976->27964 27977->27949 27978->27953 27979->27960 27980->27958 27981->27960 27982->27960 27984 7ff6d3b5084c 27983->27984 27985 7ff6d3b50879 27983->27985 27984->27985 27986 7ff6d3b50856 27984->27986 27987 7ff6d3b50881 27984->27987 27985->27976 27997 7ff6d3b5a814 37 API calls 2 library calls 27986->27997 27990 7ff6d3b5076c 27987->27990 27998 7ff6d3b5546c EnterCriticalSection 27990->27998 27992 7ff6d3b50789 27993 7ff6d3b507ac 74 API calls 27992->27993 27994 7ff6d3b50792 27993->27994 27995 7ff6d3b55478 _fread_nolock LeaveCriticalSection 27994->27995 27996 7ff6d3b5079d 27995->27996 27996->27985 27997->27985 28002 7ff6d3b549de 27999->28002 28000 7ff6d3b54a03 28017 7ff6d3b5a814 37 API calls 2 library calls 28000->28017 28002->28000 28003 7ff6d3b54a3f 28002->28003 28018 7ff6d3b52c10 49 API calls _invalid_parameter_noinfo 28003->28018 28005 7ff6d3b54ad6 28009 7ff6d3b54b1c 28005->28009 28010 7ff6d3b54b40 28005->28010 28011 7ff6d3b54af1 28005->28011 28014 7ff6d3b54ae8 28005->28014 28006 7ff6d3b4c550 _log10_special 8 API calls 28008 7ff6d3b41cc8 28006->28008 28007 7ff6d3b5a948 __free_lconv_mon 11 API calls 28016 7ff6d3b54a2d 28007->28016 28008->27416 28009->28007 28010->28009 28012 7ff6d3b54b4a 28010->28012 28019 7ff6d3b5a948 28011->28019 28015 7ff6d3b5a948 __free_lconv_mon 11 API calls 28012->28015 28014->28009 28014->28011 28015->28016 28016->28006 28017->28016 28018->28005 28020 7ff6d3b5a94d RtlFreeHeap 28019->28020 28024 7ff6d3b5a97c 28019->28024 28021 7ff6d3b5a968 GetLastError 28020->28021 28020->28024 28022 7ff6d3b5a975 __free_lconv_mon 28021->28022 28025 7ff6d3b54f08 11 API calls _set_fmode 28022->28025 28024->28016 28025->28024 28027 7ff6d3b55ec8 28026->28027 28028 7ff6d3b55eee 28027->28028 28030 7ff6d3b55f21 28027->28030 28057 7ff6d3b54f08 11 API calls _set_fmode 28028->28057 28032 7ff6d3b55f27 28030->28032 28033 7ff6d3b55f34 28030->28033 28031 7ff6d3b55ef3 28058 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28031->28058 28059 7ff6d3b54f08 11 API calls _set_fmode 28032->28059 28045 7ff6d3b5ac28 28033->28045 28035 7ff6d3b44616 28035->27668 28039 7ff6d3b55f48 28060 7ff6d3b54f08 11 API calls _set_fmode 28039->28060 28040 7ff6d3b55f55 28052 7ff6d3b5fecc 28040->28052 28043 7ff6d3b55f68 28061 7ff6d3b55478 LeaveCriticalSection 28043->28061 28062 7ff6d3b602d8 EnterCriticalSection 28045->28062 28047 7ff6d3b5ac3f 28048 7ff6d3b5ac9c 19 API calls 28047->28048 28049 7ff6d3b5ac4a 28048->28049 28050 7ff6d3b60338 _isindst LeaveCriticalSection 28049->28050 28051 7ff6d3b55f3e 28050->28051 28051->28039 28051->28040 28063 7ff6d3b5fbc8 28052->28063 28056 7ff6d3b5ff26 28056->28043 28057->28031 28058->28035 28059->28035 28060->28035 28069 7ff6d3b5fc03 __vcrt_FlsAlloc 28063->28069 28064 7ff6d3b5fdca 28068 7ff6d3b5fdd3 28064->28068 28081 7ff6d3b54f08 11 API calls _set_fmode 28064->28081 28066 7ff6d3b5fea1 28082 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28066->28082 28068->28056 28075 7ff6d3b66d54 28068->28075 28069->28064 28078 7ff6d3b57a3c 51 API calls 3 library calls 28069->28078 28071 7ff6d3b5fe35 28071->28064 28079 7ff6d3b57a3c 51 API calls 3 library calls 28071->28079 28073 7ff6d3b5fe54 28073->28064 28080 7ff6d3b57a3c 51 API calls 3 library calls 28073->28080 28083 7ff6d3b66354 28075->28083 28078->28071 28079->28073 28080->28064 28081->28066 28082->28068 28084 7ff6d3b6636b 28083->28084 28086 7ff6d3b66389 28083->28086 28137 7ff6d3b54f08 11 API calls _set_fmode 28084->28137 28086->28084 28087 7ff6d3b663a5 28086->28087 28094 7ff6d3b66964 28087->28094 28088 7ff6d3b66370 28138 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28088->28138 28092 7ff6d3b6637c 28092->28056 28140 7ff6d3b66698 28094->28140 28097 7ff6d3b669d9 28171 7ff6d3b54ee8 11 API calls _set_fmode 28097->28171 28098 7ff6d3b669f1 28159 7ff6d3b58520 28098->28159 28101 7ff6d3b669de 28172 7ff6d3b54f08 11 API calls _set_fmode 28101->28172 28111 7ff6d3b663d0 28111->28092 28139 7ff6d3b584f8 LeaveCriticalSection 28111->28139 28137->28088 28138->28092 28141 7ff6d3b666c4 28140->28141 28149 7ff6d3b666de 28140->28149 28141->28149 28184 7ff6d3b54f08 11 API calls _set_fmode 28141->28184 28143 7ff6d3b666d3 28185 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28143->28185 28145 7ff6d3b667ad 28155 7ff6d3b6680a 28145->28155 28190 7ff6d3b59b78 37 API calls 2 library calls 28145->28190 28146 7ff6d3b6675c 28146->28145 28188 7ff6d3b54f08 11 API calls _set_fmode 28146->28188 28149->28146 28186 7ff6d3b54f08 11 API calls _set_fmode 28149->28186 28150 7ff6d3b66806 28150->28155 28191 7ff6d3b5a900 IsProcessorFeaturePresent 28150->28191 28151 7ff6d3b667a2 28189 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28151->28189 28154 7ff6d3b66751 28187 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28154->28187 28155->28097 28155->28098 28196 7ff6d3b602d8 EnterCriticalSection 28159->28196 28171->28101 28172->28111 28184->28143 28185->28149 28186->28154 28187->28146 28188->28151 28189->28145 28190->28150 28192 7ff6d3b5a913 28191->28192 28195 7ff6d3b5a614 14 API calls 3 library calls 28192->28195 28194 7ff6d3b5a92e GetCurrentProcess TerminateProcess 28195->28194 28198 7ff6d3b578f8 28197->28198 28201 7ff6d3b573d4 28198->28201 28200 7ff6d3b57911 28200->27678 28202 7ff6d3b5741e 28201->28202 28203 7ff6d3b573ef 28201->28203 28211 7ff6d3b5546c EnterCriticalSection 28202->28211 28212 7ff6d3b5a814 37 API calls 2 library calls 28203->28212 28206 7ff6d3b5740f 28206->28200 28207 7ff6d3b57423 28208 7ff6d3b57440 38 API calls 28207->28208 28209 7ff6d3b5742f 28208->28209 28210 7ff6d3b55478 _fread_nolock LeaveCriticalSection 28209->28210 28210->28206 28212->28206 28214 7ff6d3b4fe43 28213->28214 28215 7ff6d3b4fe71 28213->28215 28224 7ff6d3b5a814 37 API calls 2 library calls 28214->28224 28216 7ff6d3b4fe63 28215->28216 28223 7ff6d3b5546c EnterCriticalSection 28215->28223 28216->27682 28219 7ff6d3b4fe88 28220 7ff6d3b4fea4 72 API calls 28219->28220 28221 7ff6d3b4fe94 28220->28221 28222 7ff6d3b55478 _fread_nolock LeaveCriticalSection 28221->28222 28222->28216 28224->28216 28225->27699 28227 7ff6d3b5f98c 28228 7ff6d3b5fb7e 28227->28228 28230 7ff6d3b5f9ce _isindst 28227->28230 28273 7ff6d3b54f08 11 API calls _set_fmode 28228->28273 28230->28228 28233 7ff6d3b5fa4e _isindst 28230->28233 28231 7ff6d3b4c550 _log10_special 8 API calls 28232 7ff6d3b5fb99 28231->28232 28248 7ff6d3b66194 28233->28248 28238 7ff6d3b5fbaa 28240 7ff6d3b5a900 _isindst 17 API calls 28238->28240 28241 7ff6d3b5fbbe 28240->28241 28245 7ff6d3b5faab 28247 7ff6d3b5fb6e 28245->28247 28272 7ff6d3b661d8 37 API calls _isindst 28245->28272 28247->28231 28249 7ff6d3b661a3 28248->28249 28252 7ff6d3b5fa6c 28248->28252 28274 7ff6d3b602d8 EnterCriticalSection 28249->28274 28251 7ff6d3b661ab 28251->28252 28253 7ff6d3b66004 55 API calls 28251->28253 28254 7ff6d3b65598 28252->28254 28253->28252 28255 7ff6d3b5fa81 28254->28255 28256 7ff6d3b655a1 28254->28256 28255->28238 28260 7ff6d3b655c8 28255->28260 28275 7ff6d3b54f08 11 API calls _set_fmode 28256->28275 28258 7ff6d3b655a6 28276 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28258->28276 28261 7ff6d3b5fa92 28260->28261 28262 7ff6d3b655d1 28260->28262 28261->28238 28266 7ff6d3b655f8 28261->28266 28277 7ff6d3b54f08 11 API calls _set_fmode 28262->28277 28264 7ff6d3b655d6 28278 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28264->28278 28267 7ff6d3b5faa3 28266->28267 28268 7ff6d3b65601 28266->28268 28267->28238 28267->28245 28279 7ff6d3b54f08 11 API calls _set_fmode 28268->28279 28270 7ff6d3b65606 28280 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28270->28280 28272->28247 28273->28247 28275->28258 28276->28255 28277->28264 28278->28261 28279->28270 28280->28267 28281 7ff6d3b55628 28282 7ff6d3b55642 28281->28282 28283 7ff6d3b5565f 28281->28283 28332 7ff6d3b54ee8 11 API calls _set_fmode 28282->28332 28283->28282 28284 7ff6d3b55672 CreateFileW 28283->28284 28286 7ff6d3b556dc 28284->28286 28287 7ff6d3b556a6 28284->28287 28335 7ff6d3b55c04 46 API calls 3 library calls 28286->28335 28306 7ff6d3b5577c GetFileType 28287->28306 28288 7ff6d3b55647 28333 7ff6d3b54f08 11 API calls _set_fmode 28288->28333 28293 7ff6d3b556e1 28298 7ff6d3b556e5 28293->28298 28299 7ff6d3b55710 28293->28299 28294 7ff6d3b5564f 28334 7ff6d3b5a8e0 37 API calls _invalid_parameter_noinfo 28294->28334 28296 7ff6d3b556bb CloseHandle 28301 7ff6d3b5565a 28296->28301 28297 7ff6d3b556d1 CloseHandle 28297->28301 28336 7ff6d3b54e7c 11 API calls 2 library calls 28298->28336 28337 7ff6d3b559c4 28299->28337 28305 7ff6d3b556ef 28305->28301 28307 7ff6d3b557ca 28306->28307 28308 7ff6d3b55887 28306->28308 28309 7ff6d3b557f6 GetFileInformationByHandle 28307->28309 28355 7ff6d3b55b00 21 API calls _fread_nolock 28307->28355 28310 7ff6d3b5588f 28308->28310 28311 7ff6d3b558b1 28308->28311 28314 7ff6d3b558a2 GetLastError 28309->28314 28315 7ff6d3b5581f 28309->28315 28310->28314 28316 7ff6d3b55893 28310->28316 28312 7ff6d3b558d4 PeekNamedPipe 28311->28312 28330 7ff6d3b55872 28311->28330 28312->28330 28358 7ff6d3b54e7c 11 API calls 2 library calls 28314->28358 28317 7ff6d3b559c4 51 API calls 28315->28317 28357 7ff6d3b54f08 11 API calls _set_fmode 28316->28357 28322 7ff6d3b5582a 28317->28322 28320 7ff6d3b4c550 _log10_special 8 API calls 28323 7ff6d3b556b4 28320->28323 28321 7ff6d3b557e4 28321->28309 28321->28330 28348 7ff6d3b55924 28322->28348 28323->28296 28323->28297 28326 7ff6d3b55924 10 API calls 28327 7ff6d3b55849 28326->28327 28328 7ff6d3b55924 10 API calls 28327->28328 28329 7ff6d3b5585a 28328->28329 28329->28330 28356 7ff6d3b54f08 11 API calls _set_fmode 28329->28356 28330->28320 28332->28288 28333->28294 28334->28301 28335->28293 28336->28305 28339 7ff6d3b559ec 28337->28339 28338 7ff6d3b5571d 28347 7ff6d3b55b00 21 API calls _fread_nolock 28338->28347 28339->28338 28359 7ff6d3b5f724 51 API calls 2 library calls 28339->28359 28341 7ff6d3b55a80 28341->28338 28360 7ff6d3b5f724 51 API calls 2 library calls 28341->28360 28343 7ff6d3b55a93 28343->28338 28361 7ff6d3b5f724 51 API calls 2 library calls 28343->28361 28345 7ff6d3b55aa6 28345->28338 28362 7ff6d3b5f724 51 API calls 2 library calls 28345->28362 28347->28305 28349 7ff6d3b5594d FileTimeToSystemTime 28348->28349 28350 7ff6d3b55940 28348->28350 28351 7ff6d3b55961 SystemTimeToTzSpecificLocalTime 28349->28351 28352 7ff6d3b55948 28349->28352 28350->28349 28350->28352 28351->28352 28353 7ff6d3b4c550 _log10_special 8 API calls 28352->28353 28354 7ff6d3b55839 28353->28354 28354->28326 28355->28321 28356->28330 28357->28330 28358->28330 28359->28341 28360->28343 28361->28345 28362->28338 28363 7ff6d3b420c0 28364 7ff6d3b4213b GetWindowLongPtrW 28363->28364 28365 7ff6d3b420d5 28363->28365 28373 7ff6d3b42180 GetDC 28364->28373 28366 7ff6d3b420e2 28365->28366 28368 7ff6d3b4210a SetWindowLongPtrW 28365->28368 28369 7ff6d3b420f4 EndDialog 28366->28369 28371 7ff6d3b420fa 28366->28371 28372 7ff6d3b42124 28368->28372 28369->28371 28374 7ff6d3b4224d 28373->28374 28375 7ff6d3b421bd 28373->28375 28378 7ff6d3b42252 MoveWindow MoveWindow MoveWindow MoveWindow 28374->28378 28376 7ff6d3b421fb DrawTextW 28375->28376 28377 7ff6d3b421ef SelectObject 28375->28377 28380 7ff6d3b42231 ReleaseDC 28376->28380 28381 7ff6d3b42225 SelectObject 28376->28381 28377->28376 28379 7ff6d3b4c550 _log10_special 8 API calls 28378->28379 28382 7ff6d3b42158 InvalidateRect 28379->28382 28380->28378 28381->28380 28382->28371 28383 7ff6d3b42fe0 28384 7ff6d3b42ff0 28383->28384 28385 7ff6d3b4302b 28384->28385 28386 7ff6d3b43041 28384->28386 28425 7ff6d3b42710 54 API calls _log10_special 28385->28425 28388 7ff6d3b43061 28386->28388 28398 7ff6d3b43077 __std_exception_destroy 28386->28398 28426 7ff6d3b42710 54 API calls _log10_special 28388->28426 28390 7ff6d3b4c550 _log10_special 8 API calls 28391 7ff6d3b431fa 28390->28391 28392 7ff6d3b41470 116 API calls 28392->28398 28393 7ff6d3b43349 28431 7ff6d3b42710 54 API calls _log10_special 28393->28431 28394 7ff6d3b41c80 49 API calls 28394->28398 28396 7ff6d3b43333 28430 7ff6d3b42710 54 API calls _log10_special 28396->28430 28398->28392 28398->28393 28398->28394 28398->28396 28399 7ff6d3b4330d 28398->28399 28401 7ff6d3b43207 28398->28401 28410 7ff6d3b43037 __std_exception_destroy 28398->28410 28429 7ff6d3b42710 54 API calls _log10_special 28399->28429 28402 7ff6d3b43273 28401->28402 28427 7ff6d3b5a404 37 API calls 2 library calls 28401->28427 28404 7ff6d3b43290 28402->28404 28405 7ff6d3b4329e 28402->28405 28428 7ff6d3b5a404 37 API calls 2 library calls 28404->28428 28411 7ff6d3b42dd0 28405->28411 28408 7ff6d3b4329c 28415 7ff6d3b42500 28408->28415 28410->28390 28413 7ff6d3b42e04 28411->28413 28414 7ff6d3b42f6f 28413->28414 28432 7ff6d3b5a404 37 API calls 2 library calls 28413->28432 28414->28408 28416 7ff6d3b42536 28415->28416 28417 7ff6d3b4252c 28415->28417 28419 7ff6d3b4254b 28416->28419 28420 7ff6d3b49390 2 API calls 28416->28420 28418 7ff6d3b49390 2 API calls 28417->28418 28418->28416 28421 7ff6d3b42560 28419->28421 28423 7ff6d3b49390 2 API calls 28419->28423 28420->28419 28433 7ff6d3b42390 28421->28433 28423->28421 28424 7ff6d3b4257c __std_exception_destroy 28424->28410 28425->28410 28426->28410 28427->28402 28428->28408 28429->28410 28430->28410 28431->28410 28432->28414 28434 7ff6d3b4c850 28433->28434 28435 7ff6d3b423a9 GetModuleHandleW 28434->28435 28436 7ff6d3b423e5 memcpy_s 28435->28436 28452 7ff6d3b425c0 28436->28452 28438 7ff6d3b4242b memcpy_s 28456 7ff6d3b5796c 28438->28456 28441 7ff6d3b5796c 37 API calls 28442 7ff6d3b4245e 28441->28442 28443 7ff6d3b5796c 37 API calls 28442->28443 28444 7ff6d3b4246b DialogBoxIndirectParamW 28443->28444 28445 7ff6d3b424a1 __std_exception_destroy 28444->28445 28446 7ff6d3b424c7 28445->28446 28447 7ff6d3b424c1 DeleteObject 28445->28447 28448 7ff6d3b424d9 28446->28448 28449 7ff6d3b424d3 DestroyIcon 28446->28449 28447->28446 28450 7ff6d3b4c550 _log10_special 8 API calls 28448->28450 28449->28448 28451 7ff6d3b424ea 28450->28451 28451->28424 28453 7ff6d3b425e5 28452->28453 28463 7ff6d3b54bd8 28453->28463 28457 7ff6d3b5798a 28456->28457 28459 7ff6d3b42451 28456->28459 28457->28459 28483 7ff6d3b60474 37 API calls 2 library calls 28457->28483 28459->28441 28460 7ff6d3b579b9 28460->28459 28461 7ff6d3b5a900 _isindst 17 API calls 28460->28461 28462 7ff6d3b579ed 28461->28462 28467 7ff6d3b54c32 28463->28467 28464 7ff6d3b54c57 28481 7ff6d3b5a814 37 API calls 2 library calls 28464->28481 28466 7ff6d3b54c93 28482 7ff6d3b52f90 48 API calls _invalid_parameter_noinfo 28466->28482 28467->28464 28467->28466 28469 7ff6d3b54d74 28471 7ff6d3b5a948 __free_lconv_mon 11 API calls 28469->28471 28470 7ff6d3b4c550 _log10_special 8 API calls 28472 7ff6d3b42604 28470->28472 28480 7ff6d3b54c81 28471->28480 28472->28438 28473 7ff6d3b54d2e 28473->28469 28474 7ff6d3b54d9a 28473->28474 28475 7ff6d3b54d49 28473->28475 28478 7ff6d3b54d40 28473->28478 28474->28469 28476 7ff6d3b54da4 28474->28476 28477 7ff6d3b5a948 __free_lconv_mon 11 API calls 28475->28477 28479 7ff6d3b5a948 __free_lconv_mon 11 API calls 28476->28479 28477->28480 28478->28469 28478->28475 28479->28480 28480->28470 28481->28480 28482->28473 28483->28460

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 00007FF6D3B41000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 0 7ff6d3b41000-7ff6d3b43806 call 7ff6d3b4fe18 call 7ff6d3b4fe20 call 7ff6d3b4c850 call 7ff6d3b553f0 call 7ff6d3b55484 call 7ff6d3b436b0 14 7ff6d3b43808-7ff6d3b4380f 0->14 15 7ff6d3b43814-7ff6d3b43836 call 7ff6d3b41950 0->15 16 7ff6d3b43c97-7ff6d3b43cb2 call 7ff6d3b4c550 14->16 20 7ff6d3b4383c-7ff6d3b43856 call 7ff6d3b41c80 15->20 21 7ff6d3b4391b-7ff6d3b43931 call 7ff6d3b445c0 15->21 25 7ff6d3b4385b-7ff6d3b4389b call 7ff6d3b48830 20->25 28 7ff6d3b4396a-7ff6d3b4397f call 7ff6d3b42710 21->28 29 7ff6d3b43933-7ff6d3b43960 call 7ff6d3b47f90 21->29 35 7ff6d3b4389d-7ff6d3b438a3 25->35 36 7ff6d3b438c1-7ff6d3b438cc call 7ff6d3b54f30 25->36 39 7ff6d3b43c8f 28->39 37 7ff6d3b43984-7ff6d3b439a6 call 7ff6d3b41c80 29->37 38 7ff6d3b43962-7ff6d3b43965 call 7ff6d3b5004c 29->38 40 7ff6d3b438af-7ff6d3b438bd call 7ff6d3b489a0 35->40 41 7ff6d3b438a5-7ff6d3b438ad 35->41 47 7ff6d3b439fc-7ff6d3b43a2a call 7ff6d3b48940 call 7ff6d3b489a0 * 3 36->47 48 7ff6d3b438d2-7ff6d3b438e1 call 7ff6d3b48830 36->48 53 7ff6d3b439b0-7ff6d3b439b9 37->53 38->28 39->16 40->36 41->40 76 7ff6d3b43a2f-7ff6d3b43a3e call 7ff6d3b48830 47->76 57 7ff6d3b438e7-7ff6d3b438ed 48->57 58 7ff6d3b439f4-7ff6d3b439f7 call 7ff6d3b54f30 48->58 53->53 56 7ff6d3b439bb-7ff6d3b439d8 call 7ff6d3b41950 53->56 56->25 68 7ff6d3b439de-7ff6d3b439ef call 7ff6d3b42710 56->68 62 7ff6d3b438f0-7ff6d3b438fc 57->62 58->47 65 7ff6d3b438fe-7ff6d3b43903 62->65 66 7ff6d3b43905-7ff6d3b43908 62->66 65->62 65->66 66->58 69 7ff6d3b4390e-7ff6d3b43916 call 7ff6d3b54f30 66->69 68->39 69->76 79 7ff6d3b43b45-7ff6d3b43b53 76->79 80 7ff6d3b43a44-7ff6d3b43a47 76->80 81 7ff6d3b43b59-7ff6d3b43b5d 79->81 82 7ff6d3b43a67 79->82 80->79 83 7ff6d3b43a4d-7ff6d3b43a50 80->83 84 7ff6d3b43a6b-7ff6d3b43a90 call 7ff6d3b54f30 81->84 82->84 85 7ff6d3b43a56-7ff6d3b43a5a 83->85 86 7ff6d3b43b14-7ff6d3b43b17 83->86 95 7ff6d3b43aab-7ff6d3b43ac0 84->95 96 7ff6d3b43a92-7ff6d3b43aa6 call 7ff6d3b48940 84->96 85->86 87 7ff6d3b43a60 85->87 88 7ff6d3b43b19-7ff6d3b43b1d 86->88 89 7ff6d3b43b2f-7ff6d3b43b40 call 7ff6d3b42710 86->89 87->82 88->89 91 7ff6d3b43b1f-7ff6d3b43b2a 88->91 97 7ff6d3b43c7f-7ff6d3b43c87 89->97 91->84 99 7ff6d3b43be8-7ff6d3b43bfa call 7ff6d3b48830 95->99 100 7ff6d3b43ac6-7ff6d3b43aca 95->100 96->95 97->39 108 7ff6d3b43bfc-7ff6d3b43c02 99->108 109 7ff6d3b43c2e 99->109 102 7ff6d3b43bcd-7ff6d3b43be2 call 7ff6d3b41940 100->102 103 7ff6d3b43ad0-7ff6d3b43ae8 call 7ff6d3b55250 100->103 102->99 102->100 113 7ff6d3b43aea-7ff6d3b43b02 call 7ff6d3b55250 103->113 114 7ff6d3b43b62-7ff6d3b43b7a call 7ff6d3b55250 103->114 111 7ff6d3b43c1e-7ff6d3b43c2c 108->111 112 7ff6d3b43c04-7ff6d3b43c1c 108->112 115 7ff6d3b43c31-7ff6d3b43c40 call 7ff6d3b54f30 109->115 111->115 112->115 113->102 126 7ff6d3b43b08-7ff6d3b43b0f 113->126 124 7ff6d3b43b87-7ff6d3b43b9f call 7ff6d3b55250 114->124 125 7ff6d3b43b7c-7ff6d3b43b80 114->125 122 7ff6d3b43c46-7ff6d3b43c4a 115->122 123 7ff6d3b43d41-7ff6d3b43d63 call 7ff6d3b444e0 115->123 127 7ff6d3b43c50-7ff6d3b43c5f call 7ff6d3b490e0 122->127 128 7ff6d3b43cd4-7ff6d3b43ce6 call 7ff6d3b48830 122->128 137 7ff6d3b43d71-7ff6d3b43d82 call 7ff6d3b41c80 123->137 138 7ff6d3b43d65-7ff6d3b43d6f call 7ff6d3b44630 123->138 139 7ff6d3b43bac-7ff6d3b43bc4 call 7ff6d3b55250 124->139 140 7ff6d3b43ba1-7ff6d3b43ba5 124->140 125->124 126->102 142 7ff6d3b43c61 127->142 143 7ff6d3b43cb3-7ff6d3b43cbd call 7ff6d3b48660 127->143 144 7ff6d3b43ce8-7ff6d3b43ceb 128->144 145 7ff6d3b43d35-7ff6d3b43d3c 128->145 152 7ff6d3b43d87-7ff6d3b43d96 137->152 138->152 139->102 155 7ff6d3b43bc6 139->155 140->139 149 7ff6d3b43c68 call 7ff6d3b42710 142->149 161 7ff6d3b43cc8-7ff6d3b43ccf 143->161 162 7ff6d3b43cbf-7ff6d3b43cc6 143->162 144->145 150 7ff6d3b43ced-7ff6d3b43d10 call 7ff6d3b41c80 144->150 145->149 163 7ff6d3b43c6d-7ff6d3b43c77 149->163 167 7ff6d3b43d2b-7ff6d3b43d33 call 7ff6d3b54f30 150->167 168 7ff6d3b43d12-7ff6d3b43d26 call 7ff6d3b42710 call 7ff6d3b54f30 150->168 158 7ff6d3b43d98-7ff6d3b43d9f 152->158 159 7ff6d3b43dc4-7ff6d3b43dda call 7ff6d3b49390 152->159 155->102 158->159 165 7ff6d3b43da1-7ff6d3b43da5 158->165 171 7ff6d3b43de8-7ff6d3b43e04 SetDllDirectoryW 159->171 172 7ff6d3b43ddc 159->172 161->152 162->149 163->97 165->159 169 7ff6d3b43da7-7ff6d3b43dbe SetDllDirectoryW LoadLibraryExW 165->169 167->152 168->163 169->159 175 7ff6d3b43e0a-7ff6d3b43e19 call 7ff6d3b48830 171->175 176 7ff6d3b43f01-7ff6d3b43f08 171->176 172->171 189 7ff6d3b43e1b-7ff6d3b43e21 175->189 190 7ff6d3b43e32-7ff6d3b43e3c call 7ff6d3b54f30 175->190 178 7ff6d3b44008-7ff6d3b44010 176->178 179 7ff6d3b43f0e-7ff6d3b43f15 176->179 183 7ff6d3b44035-7ff6d3b44040 call 7ff6d3b436a0 call 7ff6d3b43360 178->183 184 7ff6d3b44012-7ff6d3b4402f PostMessageW GetMessageW 178->184 179->178 182 7ff6d3b43f1b-7ff6d3b43f25 call 7ff6d3b433c0 179->182 182->163 196 7ff6d3b43f2b-7ff6d3b43f3f call 7ff6d3b490c0 182->196 200 7ff6d3b44045-7ff6d3b44067 call 7ff6d3b43670 call 7ff6d3b46fc0 call 7ff6d3b46d70 183->200 184->183 193 7ff6d3b43e2d-7ff6d3b43e2f 189->193 194 7ff6d3b43e23-7ff6d3b43e2b 189->194 201 7ff6d3b43ef2-7ff6d3b43efc call 7ff6d3b48940 190->201 202 7ff6d3b43e42-7ff6d3b43e48 190->202 193->190 194->193 209 7ff6d3b43f41-7ff6d3b43f5e PostMessageW GetMessageW 196->209 210 7ff6d3b43f64-7ff6d3b43fa7 call 7ff6d3b48940 call 7ff6d3b489e0 call 7ff6d3b46fc0 call 7ff6d3b46d70 call 7ff6d3b488e0 196->210 201->176 202->201 206 7ff6d3b43e4e-7ff6d3b43e54 202->206 207 7ff6d3b43e56-7ff6d3b43e58 206->207 208 7ff6d3b43e5f-7ff6d3b43e61 206->208 212 7ff6d3b43e67-7ff6d3b43e83 call 7ff6d3b46dc0 call 7ff6d3b47340 207->212 213 7ff6d3b43e5a 207->213 208->176 208->212 209->210 248 7ff6d3b43fa9-7ff6d3b43fbf call 7ff6d3b48ed0 call 7ff6d3b488e0 210->248 249 7ff6d3b43ff5-7ff6d3b44003 call 7ff6d3b41900 210->249 227 7ff6d3b43e8e-7ff6d3b43e95 212->227 228 7ff6d3b43e85-7ff6d3b43e8c 212->228 213->176 231 7ff6d3b43e97-7ff6d3b43ea4 call 7ff6d3b46e00 227->231 232 7ff6d3b43eaf-7ff6d3b43eb9 call 7ff6d3b471b0 227->232 230 7ff6d3b43edb-7ff6d3b43ef0 call 7ff6d3b42a50 call 7ff6d3b46fc0 call 7ff6d3b46d70 228->230 230->176 231->232 246 7ff6d3b43ea6-7ff6d3b43ead 231->246 242 7ff6d3b43ebb-7ff6d3b43ec2 232->242 243 7ff6d3b43ec4-7ff6d3b43ed2 call 7ff6d3b474f0 232->243 242->230 243->176 256 7ff6d3b43ed4 243->256 246->230 248->249 261 7ff6d3b43fc1-7ff6d3b43fd6 248->261 249->163 256->230 262 7ff6d3b43fd8-7ff6d3b43feb call 7ff6d3b42710 call 7ff6d3b41900 261->262 263 7ff6d3b43ff0 call 7ff6d3b42a50 261->263 262->163 263->249
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                          • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                          • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                          • Opcode ID: c90270ffad0875a7836de0be6a1255abb1ac4782718776a4c79910e0e2c3782f
                                                                                                                                                                                                                                          • Instruction ID: 6178b59478a5bc247db2dfda31e707857ce18bcc70a4b53cdbb6798e16cd8c5d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c90270ffad0875a7836de0be6a1255abb1ac4782718776a4c79910e0e2c3782f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4C32BE21A0E68651EA14EB25D4563BDA760AF6A788F484033DADDE72D2EF2CE574C304
                                                                                                                                                                                                                                          Function 00007FF6D3B65C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 357 7ff6d3b65c00-7ff6d3b65c3b call 7ff6d3b65588 call 7ff6d3b65590 call 7ff6d3b655f8 364 7ff6d3b65e65-7ff6d3b65eb1 call 7ff6d3b5a900 call 7ff6d3b65588 call 7ff6d3b65590 call 7ff6d3b655f8 357->364 365 7ff6d3b65c41-7ff6d3b65c4c call 7ff6d3b65598 357->365 391 7ff6d3b65eb7-7ff6d3b65ec2 call 7ff6d3b65598 364->391 392 7ff6d3b65fef-7ff6d3b6605d call 7ff6d3b5a900 call 7ff6d3b61578 364->392 365->364 370 7ff6d3b65c52-7ff6d3b65c5c 365->370 372 7ff6d3b65c7e-7ff6d3b65c82 370->372 373 7ff6d3b65c5e-7ff6d3b65c61 370->373 376 7ff6d3b65c85-7ff6d3b65c8d 372->376 375 7ff6d3b65c64-7ff6d3b65c6f 373->375 379 7ff6d3b65c7a-7ff6d3b65c7c 375->379 380 7ff6d3b65c71-7ff6d3b65c78 375->380 376->376 381 7ff6d3b65c8f-7ff6d3b65ca2 call 7ff6d3b5d5fc 376->381 379->372 384 7ff6d3b65cab-7ff6d3b65cb9 379->384 380->375 380->379 387 7ff6d3b65cba-7ff6d3b65cc6 call 7ff6d3b5a948 381->387 388 7ff6d3b65ca4-7ff6d3b65ca6 call 7ff6d3b5a948 381->388 398 7ff6d3b65ccd-7ff6d3b65cd5 387->398 388->384 391->392 400 7ff6d3b65ec8-7ff6d3b65ed3 call 7ff6d3b655c8 391->400 411 7ff6d3b6606b-7ff6d3b6606e 392->411 412 7ff6d3b6605f-7ff6d3b66066 392->412 398->398 401 7ff6d3b65cd7-7ff6d3b65ce8 call 7ff6d3b60474 398->401 400->392 409 7ff6d3b65ed9-7ff6d3b65efc call 7ff6d3b5a948 GetTimeZoneInformation 400->409 401->364 410 7ff6d3b65cee-7ff6d3b65d44 call 7ff6d3b6a4d0 * 4 call 7ff6d3b65b1c 401->410 427 7ff6d3b65f02-7ff6d3b65f23 409->427 428 7ff6d3b65fc4-7ff6d3b65fee call 7ff6d3b65580 call 7ff6d3b65570 call 7ff6d3b65578 409->428 469 7ff6d3b65d46-7ff6d3b65d4a 410->469 413 7ff6d3b660a5-7ff6d3b660b8 call 7ff6d3b5d5fc 411->413 414 7ff6d3b66070 411->414 417 7ff6d3b660fb-7ff6d3b660fe 412->417 434 7ff6d3b660ba 413->434 435 7ff6d3b660c3-7ff6d3b660de call 7ff6d3b61578 413->435 418 7ff6d3b66073 414->418 417->418 419 7ff6d3b66104-7ff6d3b6610c call 7ff6d3b65c00 417->419 423 7ff6d3b66078-7ff6d3b660a4 call 7ff6d3b5a948 call 7ff6d3b4c550 418->423 424 7ff6d3b66073 call 7ff6d3b65e7c 418->424 419->423 424->423 436 7ff6d3b65f25-7ff6d3b65f2b 427->436 437 7ff6d3b65f2e-7ff6d3b65f35 427->437 444 7ff6d3b660bc-7ff6d3b660c1 call 7ff6d3b5a948 434->444 456 7ff6d3b660e5-7ff6d3b660f7 call 7ff6d3b5a948 435->456 457 7ff6d3b660e0-7ff6d3b660e3 435->457 436->437 438 7ff6d3b65f37-7ff6d3b65f3f 437->438 439 7ff6d3b65f49 437->439 438->439 445 7ff6d3b65f41-7ff6d3b65f47 438->445 448 7ff6d3b65f4b-7ff6d3b65fbf call 7ff6d3b6a4d0 * 4 call 7ff6d3b62b5c call 7ff6d3b66114 * 2 439->448 444->414 445->448 448->428 456->417 457->444 471 7ff6d3b65d4c 469->471 472 7ff6d3b65d50-7ff6d3b65d54 469->472 471->472 472->469 474 7ff6d3b65d56-7ff6d3b65d7b call 7ff6d3b56b58 472->474 480 7ff6d3b65d7e-7ff6d3b65d82 474->480 482 7ff6d3b65d84-7ff6d3b65d8f 480->482 483 7ff6d3b65d91-7ff6d3b65d95 480->483 482->483 485 7ff6d3b65d97-7ff6d3b65d9b 482->485 483->480 488 7ff6d3b65d9d-7ff6d3b65dc5 call 7ff6d3b56b58 485->488 489 7ff6d3b65e1c-7ff6d3b65e20 485->489 497 7ff6d3b65dc7 488->497 498 7ff6d3b65de3-7ff6d3b65de7 488->498 491 7ff6d3b65e27-7ff6d3b65e34 489->491 492 7ff6d3b65e22-7ff6d3b65e24 489->492 493 7ff6d3b65e36-7ff6d3b65e4c call 7ff6d3b65b1c 491->493 494 7ff6d3b65e4f-7ff6d3b65e5e call 7ff6d3b65580 call 7ff6d3b65570 491->494 492->491 493->494 494->364 501 7ff6d3b65dca-7ff6d3b65dd1 497->501 498->489 503 7ff6d3b65de9-7ff6d3b65e07 call 7ff6d3b56b58 498->503 501->498 504 7ff6d3b65dd3-7ff6d3b65de1 501->504 509 7ff6d3b65e13-7ff6d3b65e1a 503->509 504->498 504->501 509->489 510 7ff6d3b65e09-7ff6d3b65e0d 509->510 510->489 511 7ff6d3b65e0f 510->511 511->509
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65C45
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B65598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B655AC
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A95E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: GetLastError.KERNEL32(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A968
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6D3B5A8DF,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5A909
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6D3B5A8DF,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5A92E
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65C34
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B655F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B6560C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65EAA
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65EBB
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65ECC
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D3B6610C), ref: 00007FF6D3B65EF3
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                          • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                          • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                          • Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
                                                                                                                                                                                                                                          • Instruction ID: 9e27e1146e42af99163d2fb78503c8f594fb74d4a6b816f1de2018bdf7ba58d8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9FD1E526E0A24246EB209F21D8522BDA751FFA6794F444037DA8DEB797DF3CE4718780
                                                                                                                                                                                                                                          Function 00007FF6D3B66964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 632 7ff6d3b66964-7ff6d3b669d7 call 7ff6d3b66698 635 7ff6d3b669d9-7ff6d3b669e2 call 7ff6d3b54ee8 632->635 636 7ff6d3b669f1-7ff6d3b669fb call 7ff6d3b58520 632->636 641 7ff6d3b669e5-7ff6d3b669ec call 7ff6d3b54f08 635->641 642 7ff6d3b669fd-7ff6d3b66a14 call 7ff6d3b54ee8 call 7ff6d3b54f08 636->642 643 7ff6d3b66a16-7ff6d3b66a7f CreateFileW 636->643 659 7ff6d3b66d32-7ff6d3b66d52 641->659 642->641 645 7ff6d3b66afc-7ff6d3b66b07 GetFileType 643->645 646 7ff6d3b66a81-7ff6d3b66a87 643->646 652 7ff6d3b66b5a-7ff6d3b66b61 645->652 653 7ff6d3b66b09-7ff6d3b66b44 GetLastError call 7ff6d3b54e7c CloseHandle 645->653 649 7ff6d3b66ac9-7ff6d3b66af7 GetLastError call 7ff6d3b54e7c 646->649 650 7ff6d3b66a89-7ff6d3b66a8d 646->650 649->641 650->649 657 7ff6d3b66a8f-7ff6d3b66ac7 CreateFileW 650->657 655 7ff6d3b66b69-7ff6d3b66b6c 652->655 656 7ff6d3b66b63-7ff6d3b66b67 652->656 653->641 667 7ff6d3b66b4a-7ff6d3b66b55 call 7ff6d3b54f08 653->667 662 7ff6d3b66b72-7ff6d3b66bc7 call 7ff6d3b58438 655->662 663 7ff6d3b66b6e 655->663 656->662 657->645 657->649 671 7ff6d3b66be6-7ff6d3b66c17 call 7ff6d3b66418 662->671 672 7ff6d3b66bc9-7ff6d3b66bd5 call 7ff6d3b668a0 662->672 663->662 667->641 677 7ff6d3b66c1d-7ff6d3b66c5f 671->677 678 7ff6d3b66c19-7ff6d3b66c1b 671->678 672->671 679 7ff6d3b66bd7 672->679 681 7ff6d3b66c81-7ff6d3b66c8c 677->681 682 7ff6d3b66c61-7ff6d3b66c65 677->682 680 7ff6d3b66bd9-7ff6d3b66be1 call 7ff6d3b5aac0 678->680 679->680 680->659 684 7ff6d3b66c92-7ff6d3b66c96 681->684 685 7ff6d3b66d30 681->685 682->681 683 7ff6d3b66c67-7ff6d3b66c7c 682->683 683->681 684->685 687 7ff6d3b66c9c-7ff6d3b66ce1 CloseHandle CreateFileW 684->687 685->659 689 7ff6d3b66d16-7ff6d3b66d2b 687->689 690 7ff6d3b66ce3-7ff6d3b66d11 GetLastError call 7ff6d3b54e7c call 7ff6d3b58660 687->690 689->685 690->689
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1617910340-0
                                                                                                                                                                                                                                          • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                          • Instruction ID: db3ac2e547953e502a48c5a2f8016e3b2a09ffff5bd25c90f41fb9fb3008d75e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 06C1D432B29A4589EB10CF65C4926BC7771FB5AB98B010236DE5EAB7D5CF38D061C340
                                                                                                                                                                                                                                          Function 00007FF6D3B65E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 969 7ff6d3b65e7c-7ff6d3b65eb1 call 7ff6d3b65588 call 7ff6d3b65590 call 7ff6d3b655f8 976 7ff6d3b65eb7-7ff6d3b65ec2 call 7ff6d3b65598 969->976 977 7ff6d3b65fef-7ff6d3b6605d call 7ff6d3b5a900 call 7ff6d3b61578 969->977 976->977 982 7ff6d3b65ec8-7ff6d3b65ed3 call 7ff6d3b655c8 976->982 989 7ff6d3b6606b-7ff6d3b6606e 977->989 990 7ff6d3b6605f-7ff6d3b66066 977->990 982->977 988 7ff6d3b65ed9-7ff6d3b65efc call 7ff6d3b5a948 GetTimeZoneInformation 982->988 1003 7ff6d3b65f02-7ff6d3b65f23 988->1003 1004 7ff6d3b65fc4-7ff6d3b65fee call 7ff6d3b65580 call 7ff6d3b65570 call 7ff6d3b65578 988->1004 991 7ff6d3b660a5-7ff6d3b660b8 call 7ff6d3b5d5fc 989->991 992 7ff6d3b66070 989->992 994 7ff6d3b660fb-7ff6d3b660fe 990->994 1008 7ff6d3b660ba 991->1008 1009 7ff6d3b660c3-7ff6d3b660de call 7ff6d3b61578 991->1009 995 7ff6d3b66073 992->995 994->995 996 7ff6d3b66104-7ff6d3b6610c call 7ff6d3b65c00 994->996 999 7ff6d3b66078-7ff6d3b660a4 call 7ff6d3b5a948 call 7ff6d3b4c550 995->999 1000 7ff6d3b66073 call 7ff6d3b65e7c 995->1000 996->999 1000->999 1010 7ff6d3b65f25-7ff6d3b65f2b 1003->1010 1011 7ff6d3b65f2e-7ff6d3b65f35 1003->1011 1017 7ff6d3b660bc-7ff6d3b660c1 call 7ff6d3b5a948 1008->1017 1027 7ff6d3b660e5-7ff6d3b660f7 call 7ff6d3b5a948 1009->1027 1028 7ff6d3b660e0-7ff6d3b660e3 1009->1028 1010->1011 1012 7ff6d3b65f37-7ff6d3b65f3f 1011->1012 1013 7ff6d3b65f49 1011->1013 1012->1013 1018 7ff6d3b65f41-7ff6d3b65f47 1012->1018 1020 7ff6d3b65f4b-7ff6d3b65fbf call 7ff6d3b6a4d0 * 4 call 7ff6d3b62b5c call 7ff6d3b66114 * 2 1013->1020 1017->992 1018->1020 1020->1004 1027->994 1028->1017
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65EAA
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B655F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B6560C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65EBB
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B65598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B655AC
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF6D3B65ECC
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B655C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B655DC
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A95E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: GetLastError.KERNEL32(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A968
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D3B6610C), ref: 00007FF6D3B65EF3
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                          • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                          • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                          • Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
                                                                                                                                                                                                                                          • Instruction ID: 08b065096318db491f48ae166a327544f34530354a5bf9817533e1bbc6dc5555
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4519536E0A64246E710DF21D8835ADE760FB6A784F444137EA8DEB796DF3CE4608780
                                                                                                                                                                                                                                          Function 00007FF6D3B49280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                                                          • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                          • Instruction ID: 9e8543a07950f3cccdd1a06027269a512809f94802829efcc3a48c18142e2ea9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 64F0CD22E1A74186F7A08F50B48676EB350FB55728F040336D9ED616D4DF3CD058CA04
                                                                                                                                                                                                                                          Function 00007FFDFA830180 Relevance: 1.7, APIs: 1, Instructions: 204COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700067944.00007FFDFA821000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FFDFA820000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700023786.00007FFDFA820000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700373108.00007FFDFA97B000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700453114.00007FFDFA980000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa820000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: InfoSystem
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 31276548-0
                                                                                                                                                                                                                                          • Opcode ID: b0054afb10e4f66619171edf603becae74e7afe6d3d72f3cb96377bce576b712
                                                                                                                                                                                                                                          • Instruction ID: 33fa780d08b74d4bb476b0edf12d087c516ec480c05eac65b558fa72b5f22531
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b0054afb10e4f66619171edf603becae74e7afe6d3d72f3cb96377bce576b712
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 85A10A60F1AB0785FF5D8B55B870B3823A0BF55B84F9405B5C92E977E8DFACA5908320
                                                                                                                                                                                                                                          Function 00007FF6D3B41950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 269 7ff6d3b41950-7ff6d3b4198b call 7ff6d3b445c0 272 7ff6d3b41991-7ff6d3b419d1 call 7ff6d3b47f90 269->272 273 7ff6d3b41c4e-7ff6d3b41c72 call 7ff6d3b4c550 269->273 278 7ff6d3b419d7-7ff6d3b419e7 call 7ff6d3b506d4 272->278 279 7ff6d3b41c3b-7ff6d3b41c3e call 7ff6d3b5004c 272->279 284 7ff6d3b419e9-7ff6d3b41a03 call 7ff6d3b54f08 call 7ff6d3b42910 278->284 285 7ff6d3b41a08-7ff6d3b41a24 call 7ff6d3b5039c 278->285 283 7ff6d3b41c43-7ff6d3b41c4b 279->283 283->273 284->279 290 7ff6d3b41a26-7ff6d3b41a40 call 7ff6d3b54f08 call 7ff6d3b42910 285->290 291 7ff6d3b41a45-7ff6d3b41a5a call 7ff6d3b54f28 285->291 290->279 299 7ff6d3b41a5c-7ff6d3b41a76 call 7ff6d3b54f08 call 7ff6d3b42910 291->299 300 7ff6d3b41a7b-7ff6d3b41b05 call 7ff6d3b41c80 * 2 call 7ff6d3b506d4 call 7ff6d3b54f44 291->300 299->279 313 7ff6d3b41b0a-7ff6d3b41b14 300->313 314 7ff6d3b41b16-7ff6d3b41b30 call 7ff6d3b54f08 call 7ff6d3b42910 313->314 315 7ff6d3b41b35-7ff6d3b41b4e call 7ff6d3b5039c 313->315 314->279 321 7ff6d3b41b50-7ff6d3b41b6a call 7ff6d3b54f08 call 7ff6d3b42910 315->321 322 7ff6d3b41b6f-7ff6d3b41b8b call 7ff6d3b50110 315->322 321->279 329 7ff6d3b41b8d-7ff6d3b41b99 call 7ff6d3b42710 322->329 330 7ff6d3b41b9e-7ff6d3b41bac 322->330 329->279 330->279 333 7ff6d3b41bb2-7ff6d3b41bb9 330->333 335 7ff6d3b41bc1-7ff6d3b41bc7 333->335 336 7ff6d3b41bc9-7ff6d3b41bd6 335->336 337 7ff6d3b41be0-7ff6d3b41bef 335->337 338 7ff6d3b41bf1-7ff6d3b41bfa 336->338 337->337 337->338 339 7ff6d3b41bfc-7ff6d3b41bff 338->339 340 7ff6d3b41c0f 338->340 339->340 341 7ff6d3b41c01-7ff6d3b41c04 339->341 342 7ff6d3b41c11-7ff6d3b41c24 340->342 341->340 343 7ff6d3b41c06-7ff6d3b41c09 341->343 344 7ff6d3b41c26 342->344 345 7ff6d3b41c2d-7ff6d3b41c39 342->345 343->340 346 7ff6d3b41c0b-7ff6d3b41c0d 343->346 344->345 345->279 345->335 346->342
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B47F90: _fread_nolock.LIBCMT ref: 00007FF6D3B4803A
                                                                                                                                                                                                                                          • _fread_nolock.LIBCMT ref: 00007FF6D3B41A1B
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6D3B41B6A), ref: 00007FF6D3B4295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                          • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                          • Opcode ID: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
                                                                                                                                                                                                                                          • Instruction ID: 8f6936373afc2e4753a2f56edd1fbf91f064901a680496b08bc95a1b371624c7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 94819071E0A68685EA10DB14D4432BDA3A0EB6A788F409433D9CDEB786DE3CE565CB44
                                                                                                                                                                                                                                          Function 00007FF6D3B42180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                          • String ID: P%
                                                                                                                                                                                                                                          • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                          • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction ID: fc1c65b06976659e4b286c2cc0acfd4a83698c36359d7529751de6fb8edd0664
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67511726604BA187D6249F22E4181BEF7A1F7A9B65F004132EBCE83695DF3CD055DB10
                                                                                                                                                                                                                                          Function 00007FF6D3B41470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: 89ccecf573411ed4716394efc1ec480fa9932aea8d62f2b8012777f73556fdbd
                                                                                                                                                                                                                                          • Instruction ID: 7b8898447a1ec3f1d5adb5fe62c0306df338292b121af59da80dd8030463f668
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 89ccecf573411ed4716394efc1ec480fa9932aea8d62f2b8012777f73556fdbd
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C7419522A0A64285EB00DB21D4025FDE3A0FF6A798F445433ED8DAB796DE7CE521CB44
                                                                                                                                                                                                                                          Function 00007FF6D3B41210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 695 7ff6d3b41210-7ff6d3b4126d call 7ff6d3b4bd80 698 7ff6d3b41297-7ff6d3b412af call 7ff6d3b54f44 695->698 699 7ff6d3b4126f-7ff6d3b41296 call 7ff6d3b42710 695->699 704 7ff6d3b412b1-7ff6d3b412cf call 7ff6d3b54f08 call 7ff6d3b42910 698->704 705 7ff6d3b412d4-7ff6d3b412e4 call 7ff6d3b54f44 698->705 717 7ff6d3b41439-7ff6d3b4146d call 7ff6d3b4ba60 call 7ff6d3b54f30 * 2 704->717 711 7ff6d3b41309-7ff6d3b4131b 705->711 712 7ff6d3b412e6-7ff6d3b41304 call 7ff6d3b54f08 call 7ff6d3b42910 705->712 713 7ff6d3b41320-7ff6d3b41345 call 7ff6d3b5039c 711->713 712->717 723 7ff6d3b4134b-7ff6d3b41355 call 7ff6d3b50110 713->723 724 7ff6d3b41431 713->724 723->724 731 7ff6d3b4135b-7ff6d3b41367 723->731 724->717 733 7ff6d3b41370-7ff6d3b41398 call 7ff6d3b4a1c0 731->733 736 7ff6d3b41416-7ff6d3b4142c call 7ff6d3b42710 733->736 737 7ff6d3b4139a-7ff6d3b4139d 733->737 736->724 738 7ff6d3b41411 737->738 739 7ff6d3b4139f-7ff6d3b413a9 737->739 738->736 741 7ff6d3b413ab-7ff6d3b413b9 call 7ff6d3b50adc 739->741 742 7ff6d3b413d4-7ff6d3b413d7 739->742 748 7ff6d3b413be-7ff6d3b413c1 741->748 743 7ff6d3b413d9-7ff6d3b413e7 call 7ff6d3b69e30 742->743 744 7ff6d3b413ea-7ff6d3b413ef 742->744 743->744 744->733 747 7ff6d3b413f5-7ff6d3b413f8 744->747 752 7ff6d3b4140c-7ff6d3b4140f 747->752 753 7ff6d3b413fa-7ff6d3b413fd 747->753 749 7ff6d3b413cf-7ff6d3b413d2 748->749 750 7ff6d3b413c3-7ff6d3b413cd call 7ff6d3b50110 748->750 749->736 750->744 750->749 752->724 753->736 755 7ff6d3b413ff-7ff6d3b41407 753->755 755->713
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                          • Opcode ID: c49957f071027ddab990f7db31e9cb9fde1fe3b1b3a00d6674342581536df05e
                                                                                                                                                                                                                                          • Instruction ID: 9a6e23897d47fe2df6572510d419b3fecb07d32fdc635b61f0a9720435380dd1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c49957f071027ddab990f7db31e9cb9fde1fe3b1b3a00d6674342581536df05e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD51E622A0A64241EA60DB11E4423BEE290FFAA798F444136EDCDE77C5EF3CD525C704
                                                                                                                                                                                                                                          Function 00007FF6D3B436B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,00007FF6D3B43804), ref: 00007FF6D3B436E1
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B43804), ref: 00007FF6D3B436EB
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D3B43706,?,00007FF6D3B43804), ref: 00007FF6D3B42C9E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D3B43706,?,00007FF6D3B43804), ref: 00007FF6D3B42D63
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42C50: MessageBoxW.USER32 ref: 00007FF6D3B42D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                          • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                          • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                          • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                          • Instruction ID: 104751567110ef7d241d478da70b6c4771a0ab8b1a72206ac32e5c2b8b736bdd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8721B751F1E64241FA20AB20E8133BEA350BFAE388F444133D5DDE65D6EE2CE524C744
                                                                                                                                                                                                                                          Function 00007FF6D3B5BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 856 7ff6d3b5ba5c-7ff6d3b5ba82 857 7ff6d3b5ba9d-7ff6d3b5baa1 856->857 858 7ff6d3b5ba84-7ff6d3b5ba98 call 7ff6d3b54ee8 call 7ff6d3b54f08 856->858 860 7ff6d3b5be77-7ff6d3b5be83 call 7ff6d3b54ee8 call 7ff6d3b54f08 857->860 861 7ff6d3b5baa7-7ff6d3b5baae 857->861 874 7ff6d3b5be8e 858->874 880 7ff6d3b5be89 call 7ff6d3b5a8e0 860->880 861->860 863 7ff6d3b5bab4-7ff6d3b5bae2 861->863 863->860 866 7ff6d3b5bae8-7ff6d3b5baef 863->866 869 7ff6d3b5bb08-7ff6d3b5bb0b 866->869 870 7ff6d3b5baf1-7ff6d3b5bb03 call 7ff6d3b54ee8 call 7ff6d3b54f08 866->870 872 7ff6d3b5be73-7ff6d3b5be75 869->872 873 7ff6d3b5bb11-7ff6d3b5bb17 869->873 870->880 877 7ff6d3b5be91-7ff6d3b5bea8 872->877 873->872 878 7ff6d3b5bb1d-7ff6d3b5bb20 873->878 874->877 878->870 881 7ff6d3b5bb22-7ff6d3b5bb47 878->881 880->874 884 7ff6d3b5bb7a-7ff6d3b5bb81 881->884 885 7ff6d3b5bb49-7ff6d3b5bb4b 881->885 889 7ff6d3b5bb56-7ff6d3b5bb6d call 7ff6d3b54ee8 call 7ff6d3b54f08 call 7ff6d3b5a8e0 884->889 890 7ff6d3b5bb83-7ff6d3b5bbab call 7ff6d3b5d5fc call 7ff6d3b5a948 * 2 884->890 887 7ff6d3b5bb4d-7ff6d3b5bb54 885->887 888 7ff6d3b5bb72-7ff6d3b5bb78 885->888 887->888 887->889 892 7ff6d3b5bbf8-7ff6d3b5bc0f 888->892 921 7ff6d3b5bd00 889->921 917 7ff6d3b5bbad-7ff6d3b5bbc3 call 7ff6d3b54f08 call 7ff6d3b54ee8 890->917 918 7ff6d3b5bbc8-7ff6d3b5bbf3 call 7ff6d3b5c284 890->918 896 7ff6d3b5bc8a-7ff6d3b5bc94 call 7ff6d3b6391c 892->896 897 7ff6d3b5bc11-7ff6d3b5bc19 892->897 909 7ff6d3b5bc9a-7ff6d3b5bcaf 896->909 910 7ff6d3b5bd1e 896->910 897->896 901 7ff6d3b5bc1b-7ff6d3b5bc1d 897->901 901->896 902 7ff6d3b5bc1f-7ff6d3b5bc35 901->902 902->896 906 7ff6d3b5bc37-7ff6d3b5bc43 902->906 906->896 911 7ff6d3b5bc45-7ff6d3b5bc47 906->911 909->910 915 7ff6d3b5bcb1-7ff6d3b5bcc3 GetConsoleMode 909->915 913 7ff6d3b5bd23-7ff6d3b5bd43 ReadFile 910->913 911->896 916 7ff6d3b5bc49-7ff6d3b5bc61 911->916 919 7ff6d3b5be3d-7ff6d3b5be46 GetLastError 913->919 920 7ff6d3b5bd49-7ff6d3b5bd51 913->920 915->910 922 7ff6d3b5bcc5-7ff6d3b5bccd 915->922 916->896 926 7ff6d3b5bc63-7ff6d3b5bc6f 916->926 917->921 918->892 923 7ff6d3b5be48-7ff6d3b5be5e call 7ff6d3b54f08 call 7ff6d3b54ee8 919->923 924 7ff6d3b5be63-7ff6d3b5be66 919->924 920->919 928 7ff6d3b5bd57 920->928 925 7ff6d3b5bd03-7ff6d3b5bd0d call 7ff6d3b5a948 921->925 922->913 930 7ff6d3b5bccf-7ff6d3b5bcf1 ReadConsoleW 922->930 923->921 934 7ff6d3b5be6c-7ff6d3b5be6e 924->934 935 7ff6d3b5bcf9-7ff6d3b5bcfb call 7ff6d3b54e7c 924->935 925->877 926->896 933 7ff6d3b5bc71-7ff6d3b5bc73 926->933 937 7ff6d3b5bd5e-7ff6d3b5bd73 928->937 939 7ff6d3b5bcf3 GetLastError 930->939 940 7ff6d3b5bd12-7ff6d3b5bd1c 930->940 933->896 944 7ff6d3b5bc75-7ff6d3b5bc85 933->944 934->925 935->921 937->925 946 7ff6d3b5bd75-7ff6d3b5bd80 937->946 939->935 940->937 944->896 949 7ff6d3b5bda7-7ff6d3b5bdaf 946->949 950 7ff6d3b5bd82-7ff6d3b5bd9b call 7ff6d3b5b674 946->950 951 7ff6d3b5be2b-7ff6d3b5be38 call 7ff6d3b5b4b4 949->951 952 7ff6d3b5bdb1-7ff6d3b5bdc3 949->952 958 7ff6d3b5bda0-7ff6d3b5bda2 950->958 951->958 955 7ff6d3b5bdc5 952->955 956 7ff6d3b5be1e-7ff6d3b5be26 952->956 959 7ff6d3b5bdca-7ff6d3b5bdd1 955->959 956->925 958->925 961 7ff6d3b5be0d-7ff6d3b5be18 959->961 962 7ff6d3b5bdd3-7ff6d3b5bdd7 959->962 961->956 963 7ff6d3b5bdd9-7ff6d3b5bde0 962->963 964 7ff6d3b5bdf3 962->964 963->964 965 7ff6d3b5bde2-7ff6d3b5bde6 963->965 966 7ff6d3b5bdf9-7ff6d3b5be09 964->966 965->964 967 7ff6d3b5bde8-7ff6d3b5bdf1 965->967 966->959 968 7ff6d3b5be0b 966->968 967->966 968->956
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
                                                                                                                                                                                                                                          • Instruction ID: 09c10333cce9f1744bd21a5e6757d30378a463f928ad8cac17a69c9ba2d7adb8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B9C1082290E78A91E661DB15D0422BDBB50FBA3B80F554133EACDA77D1DFBCE4658B00
                                                                                                                                                                                                                                          Function 00007FF6D3B46360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                          • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                          • Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
                                                                                                                                                                                                                                          • Instruction ID: 06a1d2ad1c2b4956f8f9dbec6d2865d1e2833496cc59fd52d488f61c0cafe38b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36419931A1A68791EA11DB10E4162FDA311FF6A388F404133DADDE7696EF3CE525C744
                                                                                                                                                                                                                                          Function 00007FF6D3B42390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                          • String ID: Unhandled exception in script
                                                                                                                                                                                                                                          • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                          • Opcode ID: 3b326f38696452fedce944a8216705a7f012b21920c96e855d1ab8eaac442c5d
                                                                                                                                                                                                                                          • Instruction ID: 1b5924075824b8b68a2852fc833fa3bc585d846707d577955116eacc3df32b12
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3b326f38696452fedce944a8216705a7f012b21920c96e855d1ab8eaac442c5d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0531997261A68185EB20DF61E8561FDA360FF9A788F440136EA8D9BB49DF3CD111C740
                                                                                                                                                                                                                                          Function 00007FF6D3B5F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4170891091-0
                                                                                                                                                                                                                                          • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                          • Instruction ID: fb50f921f8bb759d4acef61e763385294a97efcea310e65d98ba60bd2199f5fe
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C9511773F06211CAEB18CF64D9566BCFB61AB66358F100236DD5DA2AE5DF38A4128700
                                                                                                                                                                                                                                          Function 00007FF6D3B5577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2780335769-0
                                                                                                                                                                                                                                          • Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
                                                                                                                                                                                                                                          • Instruction ID: a22426a67b73c91c601e54ac477b1deb45f494c138fd2290916a98df2901f0aa
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A051AF22E096458AFB10CF71D4523BDB7B1AF6AB59F104437DE8EAB689DF38D4608740
                                                                                                                                                                                                                                          Function 00007FF6D3B55628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1279662727-0
                                                                                                                                                                                                                                          • Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                          • Instruction ID: de892ab8e576f9c9ec8efd5da4867ca26454791ba687aa5cbf01c11f6515c15b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6A419062E2978283E6548B21D55137DB360FBA63A5F108336E69D93AD2DF6CE0F08700
                                                                                                                                                                                                                                          Function 00007FF6D3B420C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1956198572-0
                                                                                                                                                                                                                                          • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction ID: 852095eb79b5456f0ceda9b8043c8bef7a658c76be520df6af63f4ca1bfd4d68
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F9110C21F0D14242F654C7AAE54627D93A1EFEE7C4F448032DBC99BB8ACD7DD4E19604
                                                                                                                                                                                                                                          Function 00007FF6D3B4CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3251591375-0
                                                                                                                                                                                                                                          • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                          • Instruction ID: aa64f9fd9f9eb3647347caca1c74cc666e1bba92f27440f3d801f6fbd41c225c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59317020E4B14751FA10AB65D4133BDA3919F7BB88F445037D9CEEB2D3DE6CA4258349
                                                                                                                                                                                                                                          Function 00007FF6D3B5013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                          • Instruction ID: 96fc7fbe128566801c8badcdae99c0b129d55344f828d143bead31aae30dc847
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 06511821B0B24186F7649B25D40267EE680BFA6BA4F184636EDEDA77CDCE3CD5218701
                                                                                                                                                                                                                                          Function 00007FF6D3B5C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                                                          • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                          • Instruction ID: 4d962a753bcfec84b4b47e98d70167cfad78ec41fc9c3ac4f2edce97ce1b736e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86110421709A8181DA208B25E80517DE362AB52FF0F540332EEBD9B7D9CE7CD0618700
                                                                                                                                                                                                                                          Function 00007FF6D3B55924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3B55839), ref: 00007FF6D3B55957
                                                                                                                                                                                                                                          • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3B55839), ref: 00007FF6D3B5596D
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1707611234-0
                                                                                                                                                                                                                                          • Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                          • Instruction ID: 76ac30320aeae81e54e4da55a0c54c02a77e95638e4d1a444df991e0a751afda
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4118C3260D60282EA548B15E41203EF7A0FB96B72F500237FADAD59D8EF6CD424DB00
                                                                                                                                                                                                                                          Function 00007FF6D3B5A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RtlFreeHeap.NTDLL(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A95E
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A968
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                                                          • Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                          • Instruction ID: 354414d43e15152f63b4e89ecfa6f61b6e188eed0a02c77456b27488108e821e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 13E08610F0F60342FF499BF2E44713C93505FA7700F440036C88DF6292EE6CA8618710
                                                                                                                                                                                                                                          Function 00007FF6D3B5AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,00007FF6D3B5A9D5,?,?,00000000,00007FF6D3B5AA8A), ref: 00007FF6D3B5ABC6
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF6D3B5A9D5,?,?,00000000,00007FF6D3B5AA8A), ref: 00007FF6D3B5ABD0
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 918212764-0
                                                                                                                                                                                                                                          • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                          • Instruction ID: 132cc680452ce04a0582c0e36f1dbef21a0083cf91e9c361489536c7ba5ee46f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 57212B11F2E68201FED59751D48237DA7829FA6790F04023BDAAEF77C2CEACE4614300
                                                                                                                                                                                                                                          Function 00007FF6D3B5BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                          • Instruction ID: 9fe58b2c5fb5a79f0edf00a272c038c1cfe9c4c87b2a613c82425b2ee54e285f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F341C23290A74587EA74CA59E54227DB3A0EB67B81F140532DACEE36D1CFACE412CF50
                                                                                                                                                                                                                                          Function 00007FF6D3B47F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 840049012-0
                                                                                                                                                                                                                                          • Opcode ID: 6c0febe66f3eebf5cf339e545fce04fb5f711a7807da0d6a964a5ed0356a8643
                                                                                                                                                                                                                                          • Instruction ID: db0c0df018f09cc4e6a91f5e241a1df5cc7e462a0ac1757ed243338f64214688
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6c0febe66f3eebf5cf339e545fce04fb5f711a7807da0d6a964a5ed0356a8643
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A21EC11B1AB5146FE509B12A4063BED651BF6BBC8F884432EE8CE7786CE7EE051C304
                                                                                                                                                                                                                                          Function 00007FF6D3B5B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                          • Instruction ID: f02b05b370c25ba479474696bc5911e5cb19f181860c125bf1bec6c4f52154f4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1031B522A1A64285F711AB55D84337CBA90BFA6B90F410137E99DE73D2CFBCE4618B11
                                                                                                                                                                                                                                          Function 00007FF6D3B55F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction ID: de4fb85de5844365e7777b540fa741c36dbe45e1fb195b71cc0a810ed0472b54
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CA118121A1E64282EA619F15D40217DE664AFA6B85F444433EACEF7A96CF3CE4604700
                                                                                                                                                                                                                                          Function 00007FF6D3B66354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                          • Instruction ID: bbeec0e428d4871c7576d64ca67d3e713fcad3995fc2dd46c427dd596002aa56
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1421D732A09A418BDB618F18D44237DB7A0FBE5B54F144235EA9DDB6D6DF3CD4218B00
                                                                                                                                                                                                                                          Function 00007FF6D3B503BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction ID: 6a41d3d70381d116d3f2c9a9f2efcd13a69ad6813b5beeccb1dadd258afbb232
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BF015261A1A74581E9049B52D9021BDE6A5AFE6FE1F484632EEDCA7BDACE3CD4214300
                                                                                                                                                                                                                                          Function 00007FF6D3B48E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B49390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D3B445F4,00000000,00007FF6D3B41985), ref: 00007FF6D3B493C9
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,00007FF6D3B46476,?,00007FF6D3B4336E), ref: 00007FF6D3B48EA2
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2592636585-0
                                                                                                                                                                                                                                          • Opcode ID: 11a4aaaef8a7a10f6e0ce37232ac144c9e9b59754371ad75d1a790c2d21c933d
                                                                                                                                                                                                                                          • Instruction ID: 40e68523e49b07cfec733def944fea662803a24c8b0581497a40126e8d6de39a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 11a4aaaef8a7a10f6e0ce37232ac144c9e9b59754371ad75d1a790c2d21c933d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3D0CD01F3964541EE44E767B54767D92519F9EBC0F48C036EE4D4774ADC3CC0514B00
                                                                                                                                                                                                                                          Function 00007FF6D3B5D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,?,00007FF6D3B50C90,?,?,?,00007FF6D3B522FA,?,?,?,?,?,00007FF6D3B53AE9), ref: 00007FF6D3B5D63A
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                                          • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                          • Instruction ID: d970c797800bee96f914447cc951fd45e90f5843ab3df35178c5586a59f90ed9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CFF08210F0B28780FE557B71D85327CA1904FE67A0F080736DDAEE62C2DD2CE4A18710

                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                          Function 00007FF6D3B489E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                          • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                          • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                          • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                          • Instruction ID: 1a4b0872c89b9a799d52e0a922e97baa2613b504d9c10ef69235978034e3f025
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DAD1A332B0AA8286E710CF35E8522ADB770FFA6758F400136DA9EE6695DF7CD164C740
                                                                                                                                                                                                                                          Function 00007FFDFAAFF400 Relevance: 24.5, APIs: 16, Instructions: 493COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: log2$memset$memmove
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1685334282-0
                                                                                                                                                                                                                                          • Opcode ID: 1edd070486128180aaf4a9b6a699bce50f64173daa6afe7625103dfdb958fdbf
                                                                                                                                                                                                                                          • Instruction ID: b259c816392406d162045562e9b5f19c1d2026473852f2009a356472f83ec1d2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1edd070486128180aaf4a9b6a699bce50f64173daa6afe7625103dfdb958fdbf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D722CF32B14F8586DB1E8B3495607BEB365FF557C4F158332DAAB27698DF39E0828200
                                                                                                                                                                                                                                          Function 00007FFDFAAFFEB0 Relevance: 24.5, APIs: 16, Instructions: 493COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: log2$memset$memmove
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1685334282-0
                                                                                                                                                                                                                                          • Opcode ID: d0ebc9dcb9b4dfbefd1d47e463b8048210ff77d408c872b9899fd701b123924b
                                                                                                                                                                                                                                          • Instruction ID: 3563de36aeafeef6797cd7abfa2a63cfdcbe420900023751ae098c5aa9cbba95
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0ebc9dcb9b4dfbefd1d47e463b8048210ff77d408c872b9899fd701b123924b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FE229032B14F9586D71E8B2591607BAA365FF597C4F59C332DBAF26798DF38E0428200
                                                                                                                                                                                                                                          Function 00007FFDFA9918A0 Relevance: 13.9, APIs: 9, Instructions: 425COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Mem_$SubtypeType_$DataFreeFromKindMallocReallocUnicode_
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1742244024-0
                                                                                                                                                                                                                                          • Opcode ID: 2d17a493920b6b36c6fa0658f81e569c9b995c639d436fc25a26417b6e17d25f
                                                                                                                                                                                                                                          • Instruction ID: cd05b00f4e10eb38178837331fa99992000a89ffb652e4e056eadf2a5ed796a8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2d17a493920b6b36c6fa0658f81e569c9b995c639d436fc25a26417b6e17d25f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0202E472B0C552A2E76C8F15D464ABA36A5FF4D748FA44179DA6EC67DCEE2CE840C300
                                                                                                                                                                                                                                          Function 00007FFDFA7D1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3698825309.00007FFDFA7D1000.00000020.00000001.01000000.00000050.sdmp, Offset: 00007FFDFA7D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698771300.00007FFDFA7D0000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698872454.00007FFDFA7D3000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698924678.00007FFDFA7D4000.00000004.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699005000.00007FFDFA7D5000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7d0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 313767242-0
                                                                                                                                                                                                                                          • Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                          • Instruction ID: 18f7a4f26c8dd2fda0083b023a40ac1f8959e51c1fcca8d9124972057a6419b0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4314C72708B828AEB648F60E860BED7365FB84744F44403ADA5E57A98DF38D64CC710
                                                                                                                                                                                                                                          Function 00007FFDFA993058 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 313767242-0
                                                                                                                                                                                                                                          • Opcode ID: d5821aaf4936ad9aa18e348792a4e6496cc638c229f42c96d8f2983ca85ed40f
                                                                                                                                                                                                                                          • Instruction ID: aae9d275d44f1d09a7071ee7188618f9d39e3f8c66c65a9072fad88d65770b44
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d5821aaf4936ad9aa18e348792a4e6496cc638c229f42c96d8f2983ca85ed40f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D2314F72709B8196EB648F60E8A07EE7364FB88748F844039DA5E87A98DF38D548C710
                                                                                                                                                                                                                                          Function 00007FFDFA7E1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3699110792.00007FFDFA7E1000.00000020.00000001.01000000.0000004F.sdmp, Offset: 00007FFDFA7E0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699060536.00007FFDFA7E0000.00000002.00000001.01000000.0000004F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699173224.00007FFDFA7E6000.00000002.00000001.01000000.0000004F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699233771.00007FFDFA7EB000.00000002.00000001.01000000.0000004F.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7e0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 313767242-0
                                                                                                                                                                                                                                          • Opcode ID: 26897df24f70a55c30b919b36952ff972a20fdcb0ee0bee13c52e1828fe953fd
                                                                                                                                                                                                                                          • Instruction ID: f0900ba3109559d0aa8b248fa46f9292b422cb33b4acffffbae1474ceec932fa
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 26897df24f70a55c30b919b36952ff972a20fdcb0ee0bee13c52e1828fe953fd
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 44313C72708A8189EB649F60E8A0BFE7364FB94744F44447ADA5E47A98DF38DA48C710
                                                                                                                                                                                                                                          Function 00007FFDFA811960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3699884852.00007FFDFA811000.00000020.00000001.01000000.0000004C.sdmp, Offset: 00007FFDFA810000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699830106.00007FFDFA810000.00000002.00000001.01000000.0000004C.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699931767.00007FFDFA813000.00000002.00000001.01000000.0000004C.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699976991.00007FFDFA815000.00000002.00000001.01000000.0000004C.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa810000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 313767242-0
                                                                                                                                                                                                                                          • Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                          • Instruction ID: 09b701e14590418cbfa713d7dc4ae56a566d33ea207315b6576f154061117bae
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C6316E72B19B8199EB648F60E860BED77A0FB84744F44403ADA5E47BC8DF78D648C700
                                                                                                                                                                                                                                          Function 00007FFDFA801960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3699674451.00007FFDFA801000.00000020.00000001.01000000.0000004D.sdmp, Offset: 00007FFDFA800000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699608092.00007FFDFA800000.00000002.00000001.01000000.0000004D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699725811.00007FFDFA803000.00000002.00000001.01000000.0000004D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699783123.00007FFDFA805000.00000002.00000001.01000000.0000004D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa800000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 313767242-0
                                                                                                                                                                                                                                          • Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                          • Instruction ID: 3ae75d86e44e91836ca1dea29c6dc361126c4c7be1b4689ac24e8175c33ea882
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 14316D72B19B9189EB648F60E8607ED7764FF84744F48803ADA5D47A88DF78D648C700
                                                                                                                                                                                                                                          Function 00007FFDFA7F1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3699353959.00007FFDFA7F1000.00000020.00000001.01000000.0000004E.sdmp, Offset: 00007FFDFA7F0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699295107.00007FFDFA7F0000.00000002.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699423944.00007FFDFA7F4000.00000002.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699481779.00007FFDFA7F5000.00000004.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699533029.00007FFDFA7F6000.00000002.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7f0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 313767242-0
                                                                                                                                                                                                                                          • Opcode ID: 0a57d354b9f48531f5e4b6dcb676abd35c4c55538187d76e763eeca891f7d0db
                                                                                                                                                                                                                                          • Instruction ID: 70ae82710beb2cae41f8ae7d12ec91b4d72177a5093cdf692fb1a28bb5f572d3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a57d354b9f48531f5e4b6dcb676abd35c4c55538187d76e763eeca891f7d0db
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 18315A72708AC18AEB648F61E860BE97360FB84744F44407ADB5E47A88EF38D648C784
                                                                                                                                                                                                                                          Function 00007FF6D3B483C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B4842B
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484AE
                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484CD
                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484DB
                                                                                                                                                                                                                                          • FindClose.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484EC
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF6D3B48919,00007FF6D3B43FA5), ref: 00007FF6D3B484F5
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                          • String ID: %s\*
                                                                                                                                                                                                                                          • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                          • Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                          • Instruction ID: 4024d86869051796e230551522bb4bbebeb91a5d9a0da31b5dccb9c9c9c54f5e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B41E521A0E94291EA20DB24F4461BEA3A0FBBA758F400233D5DEE36C5EF3DD555C744
                                                                                                                                                                                                                                          Function 00007FFDFAAF7660 Relevance: 10.8, APIs: 7, Instructions: 267COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: log2$memset
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3759962277-0
                                                                                                                                                                                                                                          • Opcode ID: 0a616068c14d0cc25b55d560957346411adc6e39c4d7ed9e6f163420d756dbf1
                                                                                                                                                                                                                                          • Instruction ID: 85ec6af82ab51d091a6f1fd5f67fe7ec3c959582ce53c69046d074f368ec9347
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a616068c14d0cc25b55d560957346411adc6e39c4d7ed9e6f163420d756dbf1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F0B1F525F18F9589E70F87348120BBAB326AF557D4F56C372E95F26798DB7DA0838200
                                                                                                                                                                                                                                          Function 00007FFDFAAE6F40 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: exitmemset
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2099101326-2920267241
                                                                                                                                                                                                                                          • Opcode ID: 1e7f654b3abe498549c85a9da2b5d6289def08c45c33cc899f933d97bd9daf92
                                                                                                                                                                                                                                          • Instruction ID: bb3217f37c310cb5fcc0a00208ad0652ca6262c3390356b8a36b5d9b7ec73271
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1e7f654b3abe498549c85a9da2b5d6289def08c45c33cc899f933d97bd9daf92
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DFC11672618BC582D764CB16F8907AAB7A4F789B84F544126EFDC43B99DF38C156CB00
                                                                                                                                                                                                                                          Function 00007FF6D3B4D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3140674995-0
                                                                                                                                                                                                                                          • Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                          • Instruction ID: a6ae263c734a39bcee53a6c4f0df8e4a4c069b7319012be0741a3f16866e6022
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8C316272A0AB8186EB60DF61E8413EE73B0FB95708F04403ADA8E97B95DF78D158C744
                                                                                                                                                                                                                                          Function 00007FFDFAAE2700 Relevance: 9.2, APIs: 6, Instructions: 239COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memset$log2
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3851851888-0
                                                                                                                                                                                                                                          • Opcode ID: 630956aaa5f078cabb962465cabea9a2edb90d42bcb192cf7cf7d8a395303877
                                                                                                                                                                                                                                          • Instruction ID: af96e1089cba0aea5d0ee95791a086a3ef1d3545781d4e4f744347f8e0b60e30
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 630956aaa5f078cabb962465cabea9a2edb90d42bcb192cf7cf7d8a395303877
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 42A14922B18BC585EB1A8B35A450BBAB355FF96780F448232DA5E1769DCF3CE44AC700
                                                                                                                                                                                                                                          Function 00007FFDFAAE0EB0 Relevance: 9.2, APIs: 6, Instructions: 239COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memset$log2
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3851851888-0
                                                                                                                                                                                                                                          • Opcode ID: 9cac2ff7569d438a0fc14b80d39a9464d9c8e47c46ba66bb0d0afa152fd710d5
                                                                                                                                                                                                                                          • Instruction ID: 0d4923da37f880d893c576b5cd1f6314f3b2e74a3bdac057f859cadbaf834a33
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9cac2ff7569d438a0fc14b80d39a9464d9c8e47c46ba66bb0d0afa152fd710d5
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 98A15922B18BD585E71ACB31A460BAAB765FF567C0F448331DA5E17699CF3CE446C300
                                                                                                                                                                                                                                          Function 00007FF6D3B5A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1239891234-0
                                                                                                                                                                                                                                          • Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                          • Instruction ID: 2ac721f7b39c3bb915d6974a99856543f1d5238beba40c2239848304747f5da6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D531B432A09B8186DB60CF25E8412AEB7B4FB9A758F400136EACD97B95DF3CC155CB40
                                                                                                                                                                                                                                          Function 00007FFDFAADE090 Relevance: 7.9, APIs: 5, Instructions: 359COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFDFAADE341
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFDFAADE3C5
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFDFAADE551
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFDFAADE5B0
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FFDFAADE600
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: log2
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4048861018-0
                                                                                                                                                                                                                                          • Opcode ID: 4ce18a24f6bbc4e66d1632d99029d87051404aa3dbe531e978db1d1c2478575e
                                                                                                                                                                                                                                          • Instruction ID: 1f50d92643298b5e316e4d2894bb8f3da06061b4ce98014827238f304670893d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4ce18a24f6bbc4e66d1632d99029d87051404aa3dbe531e978db1d1c2478575e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BBE1FB71F18E8589E72F87389120BB9B356EF997D4F148375D59F22798EB3DA0838600
                                                                                                                                                                                                                                          Function 00007FF6D3B61874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2227656907-0
                                                                                                                                                                                                                                          • Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
                                                                                                                                                                                                                                          • Instruction ID: 15191ec77bb6875172c200fafe11f43109fa113942a51f9eab0696c579189478
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3FB1E922B1A69241EA61DB21D9021BDE350FB66BE4F446133DADDABBC6DF3CE451C340
                                                                                                                                                                                                                                          Function 00007FFDFAAF7AA0 Relevance: 6.2, APIs: 4, Instructions: 169COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: log2$memset
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3759962277-0
                                                                                                                                                                                                                                          • Opcode ID: 7cb003af3fe56c2fa4ef3186a0cf0e2ba4dccb740a689c643034ce6301a7a5df
                                                                                                                                                                                                                                          • Instruction ID: 434c64bcc4871607bfd61790e66849b8c66c353a7772ee503d08473dc333d0b1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7cb003af3fe56c2fa4ef3186a0cf0e2ba4dccb740a689c643034ce6301a7a5df
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B614861F08FC549EB2F87349121BBAA366AF957D4F45C372D95F36688EF2CA0438500
                                                                                                                                                                                                                                          Function 00007FFDFA7F2EB0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3699353959.00007FFDFA7F1000.00000020.00000001.01000000.0000004E.sdmp, Offset: 00007FFDFA7F0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699295107.00007FFDFA7F0000.00000002.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699423944.00007FFDFA7F4000.00000002.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699481779.00007FFDFA7F5000.00000004.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699533029.00007FFDFA7F6000.00000002.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7f0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _wassert
                                                                                                                                                                                                                                          • String ID: OCB_ENCRYPT==direction || OCB_DECRYPT==direction$src/raw_ocb.c
                                                                                                                                                                                                                                          • API String ID: 3234217646-1106498308
                                                                                                                                                                                                                                          • Opcode ID: 96f1c7f081ec5b5f110a8a436ffb5769e61779f6ca8b250aca86d5a0fd4485a4
                                                                                                                                                                                                                                          • Instruction ID: d18cc7dfbe5c6869b99e257a70356af33a2c53f233dbb3a2f5a6fb7995e1c827
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 96f1c7f081ec5b5f110a8a436ffb5769e61779f6ca8b250aca86d5a0fd4485a4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FCE1294210D6E048C7168F7590206BE7FF0DB1FA59F4D81B6EBE94E58BD508C344EB2A
                                                                                                                                                                                                                                          Function 00007FF6D3B45830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45840
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45852
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45889
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4589B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B458B4
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B458C6
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B458DF
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B458F1
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4590D
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4591F
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4593B
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4594D
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45969
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B4597B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B45997
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B459A9
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B459C5
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF6D3B464CF,?,00007FF6D3B4336E), ref: 00007FF6D3B459D7
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                          • API String ID: 199729137-653951865
                                                                                                                                                                                                                                          • Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                          • Instruction ID: f33626eff7058dd32c4baed28ad69f729829b27d3f3f97e3aad35f916dbeb42d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0022CE6090FF0B91FA15DB56A81257CA360AF3B745F445037C49EEA262FF7CA468C684
                                                                                                                                                                                                                                          Function 00007FF6D3B476C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                          • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                          • Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                          • Instruction ID: 190fecef224590d099aeb9953e3a96dcada948ffa2ce54731804f791073b5b02
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0D02B82090FF0791EA14DB56A81357CA365EF7A744F441037C8EEAA262EF7CB569C680
                                                                                                                                                                                                                                          Function 00007FFDFAAB1EE0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 76COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Module_$Constant$Object$ReadyType_$Create2Err_ExceptionString
                                                                                                                                                                                                                                          • String ID: %d.%d.%d$Compressor$Decompressor$MODE_FONT$MODE_GENERIC$MODE_TEXT$__version__$brotli.error$error
                                                                                                                                                                                                                                          • API String ID: 85873462-3709432877
                                                                                                                                                                                                                                          • Opcode ID: c527ea57f1a6fa79dc78c15721b8764123cc718b26bb66bf4bdf31074b340112
                                                                                                                                                                                                                                          • Instruction ID: 349d9397248a02447f3a52977c23b34e469e6c33bbe861971435e22dcd5f02b4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c527ea57f1a6fa79dc78c15721b8764123cc718b26bb66bf4bdf31074b340112
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0131FC61B1CA1791FB089B11F834A752365FF58784FC8D1B2C92E46AA8EF7DE189C740
                                                                                                                                                                                                                                          Function 00007FFDFAAB1C80 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DeallocSizeString$Arg_Buffer_Bytes_Err_FromKeywords_List_ParseReleaseTuplefreemalloc
                                                                                                                                                                                                                                          • String ID: BrotliDecompress failed$y*|:decompress
                                                                                                                                                                                                                                          • API String ID: 3129089932-3609120798
                                                                                                                                                                                                                                          • Opcode ID: 21fc62796acf40556abf5966d126bf01a84e1109d329ffa3a643c5993f22310f
                                                                                                                                                                                                                                          • Instruction ID: afa3fa649189f2fccc52bca91da3b7895aa7faf8776d7024c8f13d61656f85b4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 21fc62796acf40556abf5966d126bf01a84e1109d329ffa3a643c5993f22310f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 73613A36B09B5285EB198B61E4647AD33A5FF48B88F848172CE5E53B9CEF3CD5198340
                                                                                                                                                                                                                                          Function 00007FF6D3B481D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B49390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D3B445F4,00000000,00007FF6D3B41985), ref: 00007FF6D3B493C9
                                                                                                                                                                                                                                          • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6D3B486B7,?,?,00000000,00007FF6D3B43CBB), ref: 00007FF6D3B4822C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42810: MessageBoxW.USER32 ref: 00007FF6D3B428EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                          • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                          • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                          • Opcode ID: d247d3a0ca85f1815ed913d402e51827366718a31552b00c9fe28dde0a2555e6
                                                                                                                                                                                                                                          • Instruction ID: f6191546b841ebabff1b70a6f07e0efbe92e88e76ab831d2bccaa09b736e2f32
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d247d3a0ca85f1815ed913d402e51827366718a31552b00c9fe28dde0a2555e6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6A51E911A1FA4240FA10DB25D8532BDE360EF7A788F444437E68EE66D6FE2CE5248744
                                                                                                                                                                                                                                          Function 00007FF6D3B41600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                          • Opcode ID: 7b3dbec223ebe4a5612306ee09dd1c56cff58f7effc42cf14bd45051afb99717
                                                                                                                                                                                                                                          • Instruction ID: bc78aeb8a6337fff863a6c9edd62e7dbaae9e5939f4d04dc679c259a3d4a2096
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7b3dbec223ebe4a5612306ee09dd1c56cff58f7effc42cf14bd45051afb99717
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B51CF61F0A64392EA10EB52D4021BDA360BF6A798F444533ED8CEB7D6DE3CE564C744
                                                                                                                                                                                                                                          Function 00007FFDFA9948C8 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 94COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Unicode_$CompareString$With$DeallocErr_Ready
                                                                                                                                                                                                                                          • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                                                          • API String ID: 1067165228-3528878251
                                                                                                                                                                                                                                          • Opcode ID: a97fda713efcdaed74d0f15b89fc759eef65b993e3755085a36f180e1a2a6872
                                                                                                                                                                                                                                          • Instruction ID: e992cd7ff91454339f1ab3e7b468dbc40ffdee41995c80407b7c1b66e7059019
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a97fda713efcdaed74d0f15b89fc759eef65b993e3755085a36f180e1a2a6872
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D2413221B0D643A5EB698B12A460A7A6354BF8DB8CFC445B5CD6EC76ECDF2CE448D300
                                                                                                                                                                                                                                          Function 00007FFDFA9924D0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Module_$Dealloc$ObjectObject_$Capsule_ConstantFromMallocMem_SpecStringTrackTypeType_
                                                                                                                                                                                                                                          • String ID: 14.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
                                                                                                                                                                                                                                          • API String ID: 288921926-1430584071
                                                                                                                                                                                                                                          • Opcode ID: 34ac006824e125b38f87d2d071ae01d9c336cf72669efd439cdbfbf994d14880
                                                                                                                                                                                                                                          • Instruction ID: 252e8a375f52cb7c1846257de53b7059304b0ad7aa3dd39101b8e9339f5db823
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 34ac006824e125b38f87d2d071ae01d9c336cf72669efd439cdbfbf994d14880
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CA214165F0D603B1FB1D4F25A87197A2298AF4DB98FC850B5D92EC66DCDF2CE4058301
                                                                                                                                                                                                                                          Function 00007FFDFA991090 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 150COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
                                                                                                                                                                                                                                          • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                                                          • API String ID: 1723213316-3528878251
                                                                                                                                                                                                                                          • Opcode ID: c1d1483b359176232031dcda17eceefdd4cd98cc21702f49892afc3e67e82068
                                                                                                                                                                                                                                          • Instruction ID: ae5fb6bf1506f26c2a23abd6f77e553ef9cd890f0d3d900c7821dc0c2647e11e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c1d1483b359176232031dcda17eceefdd4cd98cc21702f49892afc3e67e82068
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FC517021B0C25261FBBC8B12A875A7A5654BF4ABC8FA450B5DD6E87BD9CF2CE4058300
                                                                                                                                                                                                                                          Function 00007FF6D3B480C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                          • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                          • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                          • Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                          • Instruction ID: aa46d1b274e629ee257d64077777a0cfac235ad84beeaab1bbea465bc2cfc51d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DA21D821B0AE4282E7418B7BA84517DA360EFAEB94F484133DA9DD73D5DE6CD5A08600
                                                                                                                                                                                                                                          Function 00007FFDFA994600 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 62COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Arg_Unicode_$ArgumentCheckDigitErr_PositionalReadyString
                                                                                                                                                                                                                                          • String ID: a unicode character$argument 1$digit$not a digit
                                                                                                                                                                                                                                          • API String ID: 3305933226-4278345224
                                                                                                                                                                                                                                          • Opcode ID: f3312c4d2492d42c6bf8c5b24e15dccd6aa38fe551f57dd252bb694573ee7750
                                                                                                                                                                                                                                          • Instruction ID: a6f0020bfb6bfebfcb346601cb18bbe83601bdcff1667c41979d0d97a9f95bae
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f3312c4d2492d42c6bf8c5b24e15dccd6aa38fe551f57dd252bb694573ee7750
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3E213261B08643A1EF199B11D8649792364FF88B8CFC44572CA2EC66E8DF2DE559C300
                                                                                                                                                                                                                                          Function 00007FFDFA7D1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3698825309.00007FFDFA7D1000.00000020.00000001.01000000.00000050.sdmp, Offset: 00007FFDFA7D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698771300.00007FFDFA7D0000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698872454.00007FFDFA7D3000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698924678.00007FFDFA7D4000.00000004.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699005000.00007FFDFA7D5000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7d0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 349153199-0
                                                                                                                                                                                                                                          • Opcode ID: 31d8e522e61a33cf479bf52350be3450eaa8bff41c9a3cd264d2142d6b397c0f
                                                                                                                                                                                                                                          • Instruction ID: b748a4b1f846196aa1cb93720921f89d27672cb0e1d8fbe0bb92f4ce09c6bb05
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 31d8e522e61a33cf479bf52350be3450eaa8bff41c9a3cd264d2142d6b397c0f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 02817C21F0864346FB58AF66A471EB97690AF85780F4440B9DA6D877DEDF3DE80D8700
                                                                                                                                                                                                                                          Function 00007FFDFA992730 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 349153199-0
                                                                                                                                                                                                                                          • Opcode ID: 5ae4ae1fad975d5487a8dd9099fd26104a61e4c8513e68d9fc499fd676c40ec1
                                                                                                                                                                                                                                          • Instruction ID: fd164c249ac72dca79b28c2a5c3ad267e71a13628dd28fab30e910261c7e65ce
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ae4ae1fad975d5487a8dd9099fd26104a61e4c8513e68d9fc499fd676c40ec1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: ED81D321F0C243A6F75C9B569461ABA62D4AF4D788FD440B8D92CC73DEDE3CE8468700
                                                                                                                                                                                                                                          Function 00007FFDFA7E1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3699110792.00007FFDFA7E1000.00000020.00000001.01000000.0000004F.sdmp, Offset: 00007FFDFA7E0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699060536.00007FFDFA7E0000.00000002.00000001.01000000.0000004F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699173224.00007FFDFA7E6000.00000002.00000001.01000000.0000004F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699233771.00007FFDFA7EB000.00000002.00000001.01000000.0000004F.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7e0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 349153199-0
                                                                                                                                                                                                                                          • Opcode ID: 3667c9311effcda5bebfcd6f0c463b07b4ccdab133b9d1969c09bf43b1d98b8c
                                                                                                                                                                                                                                          • Instruction ID: e28307a4cc013811f6442c67ac6e361fa1f4ec303034a4dacc1a3deb56a420e0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3667c9311effcda5bebfcd6f0c463b07b4ccdab133b9d1969c09bf43b1d98b8c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D7818E61F1824386F758AF6598F2EBA3295AF65780F4481B5D92C877DEDE3CEC418700
                                                                                                                                                                                                                                          Function 00007FFDFA811030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3699884852.00007FFDFA811000.00000020.00000001.01000000.0000004C.sdmp, Offset: 00007FFDFA810000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699830106.00007FFDFA810000.00000002.00000001.01000000.0000004C.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699931767.00007FFDFA813000.00000002.00000001.01000000.0000004C.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699976991.00007FFDFA815000.00000002.00000001.01000000.0000004C.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa810000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 349153199-0
                                                                                                                                                                                                                                          • Opcode ID: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
                                                                                                                                                                                                                                          • Instruction ID: c76c4b50fdc8f467175fa04d20533f8c46d60a6ff8f4b679e835d93283ea8d91
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D881C160F3C24366F79C9B66A461AB96A90AF45B80F4440BDE96D837DEDFBCE4418700
                                                                                                                                                                                                                                          Function 00007FFDFA801030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3699674451.00007FFDFA801000.00000020.00000001.01000000.0000004D.sdmp, Offset: 00007FFDFA800000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699608092.00007FFDFA800000.00000002.00000001.01000000.0000004D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699725811.00007FFDFA803000.00000002.00000001.01000000.0000004D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699783123.00007FFDFA805000.00000002.00000001.01000000.0000004D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa800000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 349153199-0
                                                                                                                                                                                                                                          • Opcode ID: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
                                                                                                                                                                                                                                          • Instruction ID: 7585b4735225aa02508e814c5cc32bfccb4492fbffd42015affdc15cac710ca1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2081C221F3C26346F75C9B669461AB92A90AF557A0F4CC0B5EA6C837DEDFBCE4018700
                                                                                                                                                                                                                                          Function 00007FFDFA7F1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3699353959.00007FFDFA7F1000.00000020.00000001.01000000.0000004E.sdmp, Offset: 00007FFDFA7F0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699295107.00007FFDFA7F0000.00000002.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699423944.00007FFDFA7F4000.00000002.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699481779.00007FFDFA7F5000.00000004.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699533029.00007FFDFA7F6000.00000002.00000001.01000000.0000004E.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7f0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 349153199-0
                                                                                                                                                                                                                                          • Opcode ID: d8b20e02c901b865873e7091ce4e44ae4228cf79fcdaf74b4f9438ea969cd35b
                                                                                                                                                                                                                                          • Instruction ID: c32a56577d460bd0060b43e499dd27b99054d534d865bcf57d6ed6518c0280c2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d8b20e02c901b865873e7091ce4e44ae4228cf79fcdaf74b4f9438ea969cd35b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 98815921F082C286FB589F66A871EB93794AF55780F4441B5DB2C876DEDF2CEA0186C0
                                                                                                                                                                                                                                          Function 00007FFDFA991000 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 61COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Unicode_$Arg_$ArgumentCompareReadyStringWith$CheckPositionalSubtypeType_
                                                                                                                                                                                                                                          • String ID: argument 1$argument 2$normalize$str
                                                                                                                                                                                                                                          • API String ID: 3621440800-1320425463
                                                                                                                                                                                                                                          • Opcode ID: 94348148c340fa5468beab9ef1746397c69e42e894d14843631ab3fa4ea44381
                                                                                                                                                                                                                                          • Instruction ID: 1ee3e156660d6844b34a5b6b4604447a6855c39caad8d5100fd701685aad07fd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 94348148c340fa5468beab9ef1746397c69e42e894d14843631ab3fa4ea44381
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37219561B18783A1E7588B25D4649BA2350EF0CB9CFE441B6C97E876ECCF2DE44AC301
                                                                                                                                                                                                                                          Function 00007FFDFA9947DC Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
                                                                                                                                                                                                                                          • String ID: argument 1$argument 2$is_normalized$str
                                                                                                                                                                                                                                          • API String ID: 396090033-184702317
                                                                                                                                                                                                                                          • Opcode ID: c961abb42e83fbff4e8e9473619491438f798cfd5e47330d0c83c04a8f602896
                                                                                                                                                                                                                                          • Instruction ID: 1189bdc3072d53378e5a5693c6220e02fc9bcc2167c1456426a4600b87ffd5d8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c961abb42e83fbff4e8e9473619491438f798cfd5e47330d0c83c04a8f602896
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 34217661B08B87A1E7598B16E460A752350EF8CB9CF9441B2D97E8B6ECCF2CD54AC301
                                                                                                                                                                                                                                          Function 00007FF6D3B56290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: -$:$f$p$p
                                                                                                                                                                                                                                          • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                          • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction ID: 721fae49de98b8ed2e9bdf7baeb8471508ca53cd42d0256e4d1ec101dc39a316
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0612B361E0E2438AFB606E14D1563BDF691FBB2750F845137E6C9A66C4DF3CE9A08B04
                                                                                                                                                                                                                                          Function 00007FF6D3B50FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: f$f$p$p$f
                                                                                                                                                                                                                                          • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                          • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                          • Instruction ID: 65e8d5eebab80e7b9e46db6f5ddaad0837af705d91ff1de9463882288eb2f521
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0012B662E0E14386FF209E14E05667DF6A1FBA2754F885033D6DA96AC4DF7CE5A0CB10
                                                                                                                                                                                                                                          Function 00007FFDFA7D2760 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 154COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3698825309.00007FFDFA7D1000.00000020.00000001.01000000.00000050.sdmp, Offset: 00007FFDFA7D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698771300.00007FFDFA7D0000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698872454.00007FFDFA7D3000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698924678.00007FFDFA7D4000.00000004.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699005000.00007FFDFA7D5000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7d0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _wassert$memcpy
                                                                                                                                                                                                                                          • String ID: ((Nk==4) && (Nr==10)) || ((Nk==6) && (Nr==12)) || ((Nk==8) && (Nr==14))$(idx>=1) && (idx<=10)$src/AESNI.c$src/AESNI.c
                                                                                                                                                                                                                                          • API String ID: 4292997394-722309440
                                                                                                                                                                                                                                          • Opcode ID: d39dd8ff127fcd6812d8991013f514968d842da6ae2888197d778fac17dca971
                                                                                                                                                                                                                                          • Instruction ID: ba8ef2ec6729d0d1ce15c38e4279026203528e6327bb1984138c7304048d731b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d39dd8ff127fcd6812d8991013f514968d842da6ae2888197d778fac17dca971
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F361E572F0868681EB258F25E424EB97351FF94744F508275CAAD23698EF3CE58EC780
                                                                                                                                                                                                                                          Function 00007FF6D3B41050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: c7bb58550f5bcf0f519764ea051c05a3a8a65a2fbe38e578e675a30a6b1f643e
                                                                                                                                                                                                                                          • Instruction ID: 145385d352356e34713d859040889ab5466d130a1632819faa03963284b2e986
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7bb58550f5bcf0f519764ea051c05a3a8a65a2fbe38e578e675a30a6b1f643e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D418521F0A65241EA10DB56A8026BDE390FF6ABC8F445433ED8DE7796DE3CE521C744
                                                                                                                                                                                                                                          Function 00007FF6D3B48660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(?,?,00000000,00007FF6D3B43CBB), ref: 00007FF6D3B48704
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00007FF6D3B43CBB), ref: 00007FF6D3B4870A
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000,00007FF6D3B43CBB), ref: 00007FF6D3B4874C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48830: GetEnvironmentVariableW.KERNEL32(00007FF6D3B4388E), ref: 00007FF6D3B48867
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6D3B48889
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B58238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B58251
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B42810: MessageBoxW.USER32 ref: 00007FF6D3B428EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                          • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                          • Opcode ID: 881e4fca8e19ec4ab2ebb52834f4ac375ff8f2bae867f31c8bf391ae1f14406c
                                                                                                                                                                                                                                          • Instruction ID: cb8e5c69851cf2656ac6427db11c9d2d210b6fe616c3060ebaf346441c1dfe08
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 881e4fca8e19ec4ab2ebb52834f4ac375ff8f2bae867f31c8bf391ae1f14406c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 30419111B1BA4244FA10A766E5572BD9390AF6B7C8F800033DD8DEB7DADE3DE5218344
                                                                                                                                                                                                                                          Function 00007FF6D3B4EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                          • String ID: csm$csm$csm
                                                                                                                                                                                                                                          • API String ID: 849930591-393685449
                                                                                                                                                                                                                                          • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                          • Instruction ID: b51cdbf63ef3b1dd83efa285be1b8a5b6e170b50f7df5e0ad8f42b87ed47050b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 70D19532A0A74586EB609F65D4823ADB7A0FB6A78CF140136DECDA7756CF38E460C704
                                                                                                                                                                                                                                          Function 00007FFDFA9916E0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 129COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
                                                                                                                                                                                                                                          • String ID: a unicode character$argument$category
                                                                                                                                                                                                                                          • API String ID: 2803103377-2068800536
                                                                                                                                                                                                                                          • Opcode ID: c9d1e3034f28ed3d090bffcd2b1c2b74113939870b399ed50bdb72791e912429
                                                                                                                                                                                                                                          • Instruction ID: 5c3cd190a23ee972deb3b4223feea706b24b6c117e141a388ea15e783f06f093
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c9d1e3034f28ed3d090bffcd2b1c2b74113939870b399ed50bdb72791e912429
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8151C961B08A46A1EB5C8B0AD4B4A7963A1FF4CB88F944175DA6EC77D8DF3CE845D300
                                                                                                                                                                                                                                          Function 00007FF6D3B5ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF6D3B5F0AA,?,?,000001BB2F588EA8,00007FF6D3B5AD53,?,?,?,00007FF6D3B5AC4A,?,?,?,00007FF6D3B55F3E), ref: 00007FF6D3B5EE8C
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF6D3B5F0AA,?,?,000001BB2F588EA8,00007FF6D3B5AD53,?,?,?,00007FF6D3B5AC4A,?,?,?,00007FF6D3B55F3E), ref: 00007FF6D3B5EE98
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                          • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                          • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                          • Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                          • Instruction ID: 42f3f8ba380fab859dbe48318c8919f6f7b9379fa7534b5ef7cf1ab8c81b8a7c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E41F761B2BA0641EA55CB16E8026BDA391BF6BB90F4C4137DD9DE7784DF3CE4258300
                                                                                                                                                                                                                                          Function 00007FFDFA991590 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 112COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
                                                                                                                                                                                                                                          • String ID: a unicode character$argument$bidirectional
                                                                                                                                                                                                                                          • API String ID: 2803103377-2110215792
                                                                                                                                                                                                                                          • Opcode ID: 79e1f8ae2df2e93481f857dbc231cf2a034c20faf15badcceea9109bcd0af3e1
                                                                                                                                                                                                                                          • Instruction ID: 0d073283bab5cd6a634e6c5ab3695e586b24b6bb0afa5586cc7bc261e4b60b80
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 79e1f8ae2df2e93481f857dbc231cf2a034c20faf15badcceea9109bcd0af3e1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C341B461F1864262EB9C4F15C460A7A23A5FF48B88F984179DB6E872DCDF2DE8558340
                                                                                                                                                                                                                                          Function 00007FF6D3B42C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D3B43706,?,00007FF6D3B43804), ref: 00007FF6D3B42C9E
                                                                                                                                                                                                                                          • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D3B43706,?,00007FF6D3B43804), ref: 00007FF6D3B42D63
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF6D3B42D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                          • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                          • Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                          • Instruction ID: 522ace0d331280abb20c811d4e9090384b68751aa7b7581cbc81dbd8d2495f50
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD31F822B09B5142E620DB65A8012BEA7A1BF99BC8F400137EF8DE7759DF3CD516C740
                                                                                                                                                                                                                                          Function 00007FFDFA994498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FromStringUnicode_$S_snprintfSizeSubtypeType_memcpy
                                                                                                                                                                                                                                          • String ID: $%04X
                                                                                                                                                                                                                                          • API String ID: 762632776-4013080060
                                                                                                                                                                                                                                          • Opcode ID: 86c188bc8851d71fee5143397eab43a3575e426cb52b14b86a1d2f1ad77da2b4
                                                                                                                                                                                                                                          • Instruction ID: d6953e10bd9c6e5b8285e6b0c43eff2d688bfbbf2c51d1b40bc9924f7d9c6cd9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 86c188bc8851d71fee5143397eab43a3575e426cb52b14b86a1d2f1ad77da2b4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6E31C966B0898161FB2A8B14D8647B963A1FF8DB58F840375C97E876D8DF3CD549C300
                                                                                                                                                                                                                                          Function 00007FFDFAAB1070 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: String$Err_$AppendBytes_DeallocFromList_Size
                                                                                                                                                                                                                                          • String ID: Unable to allocate output buffer.
                                                                                                                                                                                                                                          • API String ID: 2547554596-2565006440
                                                                                                                                                                                                                                          • Opcode ID: 7e1e3b8c1928b2da807ddf7aa8ca177fec8d15fc26be477a22987a1ae2f2f214
                                                                                                                                                                                                                                          • Instruction ID: eb26716775ded42d4f9732d49b6492f05923e524de206eedd96447c503639dd2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7e1e3b8c1928b2da807ddf7aa8ca177fec8d15fc26be477a22987a1ae2f2f214
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F7311A21709B5281EB19CB16E8645297364FF58BD8F948272DA7E43BE8DF3DE4458300
                                                                                                                                                                                                                                          Function 00007FFDFA994A44 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
                                                                                                                                                                                                                                          • String ID: a unicode character$argument$mirrored
                                                                                                                                                                                                                                          • API String ID: 3097524968-4001128513
                                                                                                                                                                                                                                          • Opcode ID: c10d4c018a97ffc3e2d3961057942d7e2c7a14af83ba5a253b81f33c79b69d04
                                                                                                                                                                                                                                          • Instruction ID: 49d5599575e167b9a4c8227b9924e6a8821d2397b7e21716cab78ecd4d5f2bb6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c10d4c018a97ffc3e2d3961057942d7e2c7a14af83ba5a253b81f33c79b69d04
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D01A120B09643A1EB5D9B21A8649B92294EF8CB9CFC441B5D93E862DCDF3CE489C304
                                                                                                                                                                                                                                          Function 00007FFDFA9941C8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
                                                                                                                                                                                                                                          • String ID: a unicode character$argument$combining
                                                                                                                                                                                                                                          • API String ID: 3097524968-4202047184
                                                                                                                                                                                                                                          • Opcode ID: 8dcec4442920f3b8f18acdd6a11acb662b49feb7bbe0bfb657696819d5b5ca8f
                                                                                                                                                                                                                                          • Instruction ID: 6a12b1e4d45e0d63dfaef88b31d337041a395cce7bbc5fa3b5f03b6f428e0791
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8dcec4442920f3b8f18acdd6a11acb662b49feb7bbe0bfb657696819d5b5ca8f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 75016124B08643A1EB6D9B61A86097D2390BF9DB9CF8411B5D93EC62DDDF3CE489C300
                                                                                                                                                                                                                                          Function 00007FFDFAAB1470 Relevance: 12.1, APIs: 8, Instructions: 101threadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Eval_Thread$DeallocRestoreSave$Bytes_FromList_SizeString
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2275295419-0
                                                                                                                                                                                                                                          • Opcode ID: 5933d949b30942274c393e5cfa0f89909fbd9161848d49aca86a962fd84fa288
                                                                                                                                                                                                                                          • Instruction ID: 3154e07c30fc82f5caf6e62f056e1fbdc856ddfdb38058af9676061791b83091
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5933d949b30942274c393e5cfa0f89909fbd9161848d49aca86a962fd84fa288
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 65417332B08B8685EB258B11E4647AAB3A4FF94794F448176DA9D03B9DEF3CD4498740
                                                                                                                                                                                                                                          Function 00007FFDFA9911D0 Relevance: 10.8, APIs: 7, Instructions: 321COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4139299733-0
                                                                                                                                                                                                                                          • Opcode ID: b618ed634e65c7a0afdbbdfe658f43664214b0bdfe946ac4b4ba603eb4efd133
                                                                                                                                                                                                                                          • Instruction ID: f4075c04e4c25c5c302b2fbf4ff4873e59a5e55a4389e3bc2257ea5b9f5dd054
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b618ed634e65c7a0afdbbdfe658f43664214b0bdfe946ac4b4ba603eb4efd133
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 06D1E076B0C552A2EBB88B159064D7E63A5FB4D748FA401B9DA7EC66C8DF7CE841C300
                                                                                                                                                                                                                                          Function 00007FFDFAAF8D30 Relevance: 10.7, APIs: 7, Instructions: 212COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memmove$exit
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 987259897-0
                                                                                                                                                                                                                                          • Opcode ID: 896fa3ff6dc6034e01015742b7d00b17e3cd593d516e5aaf0fa330e4b8c5e894
                                                                                                                                                                                                                                          • Instruction ID: 8c8cad889fd9b32d08a0498898b4fdddfcf9406a079e822abbfd183fd9575b95
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 896fa3ff6dc6034e01015742b7d00b17e3cd593d516e5aaf0fa330e4b8c5e894
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 50B14776305BC08AD748CF29C8947AE7BA1E749B89F088179CF590B799CF39D416CB21
                                                                                                                                                                                                                                          Function 00007FF6D3B4DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DD4D
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DD5B
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DD85
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DDF3
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF6D3B4DF7A,?,?,?,00007FF6D3B4DC6C,?,?,?,00007FF6D3B4D869), ref: 00007FF6D3B4DDFF
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                          • String ID: api-ms-
                                                                                                                                                                                                                                          • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                          • Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                          • Instruction ID: 468997fbaaf68c28db69a6f4f24a634a4a2e1049a7e04f770c9a43da35da1aa4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F5310821B1BA01D1EE11DB02A40217DA3A4FF2EBA8F49013BDD9DAB386DF3CE0508304
                                                                                                                                                                                                                                          Function 00007FF6D3B42A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6D3B4351A,?,00000000,00007FF6D3B43F23), ref: 00007FF6D3B42AA0
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                          • Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                          • Instruction ID: 7989635ab41fd95f7133954cb686a10942136cc23c0ba989f73c98f18af0667b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D219F32A1AB8152E620DB51F8427EAA3A4FB997C4F400132EECCA765ADF7CD2558740
                                                                                                                                                                                                                                          Function 00007FF6D3B48570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 995526605-0
                                                                                                                                                                                                                                          • Opcode ID: f75ab0f0843ea553283f31270fa2e47dd05c34398218a1d4d57149fb78d89f01
                                                                                                                                                                                                                                          • Instruction ID: 19cc4d85126d133b276044d06981e1ec924809e135c16a9b86a40bc391ca4662
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f75ab0f0843ea553283f31270fa2e47dd05c34398218a1d4d57149fb78d89f01
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1221C121A0DA4642EA508B19F44123EE3B0EF967A4F500232EAEDD7AE5DEBDD4158B00
                                                                                                                                                                                                                                          Function 00007FF6D3B5B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
                                                                                                                                                                                                                                          • Instruction ID: ca2d0fc41749a10e5d15e4c3691350fcf07420572b874d56b89b6932bfce04da
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB21D021F0F24281F595E721D65313DD6429F667F0F084636D8BEF7AC6DE6CA4214B00
                                                                                                                                                                                                                                          Function 00007FFDFA994B40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                                                                                                                                          • String ID: a unicode character$argument 1$name
                                                                                                                                                                                                                                          • API String ID: 3545102714-4190364640
                                                                                                                                                                                                                                          • Opcode ID: dd7e525c6f15f79c0475ece0fbfed555bc2cf029fe1f0485a725b85a65e47b36
                                                                                                                                                                                                                                          • Instruction ID: 92ab965121d3a72bb5310889016b4540adad212e10f929882ba5fd8cc7232aac
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dd7e525c6f15f79c0475ece0fbfed555bc2cf029fe1f0485a725b85a65e47b36
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7F218731B08A42A5EB58DB15D560AAD3360EB88B8CF8840B2DA6D877DDDF2CD555C300
                                                                                                                                                                                                                                          Function 00007FFDFA994C90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                                                                                                                                          • String ID: a unicode character$argument 1$numeric
                                                                                                                                                                                                                                          • API String ID: 3545102714-2385192657
                                                                                                                                                                                                                                          • Opcode ID: 35c9d41c65e7a6057b424292e649dab30af98cc9056b9a63245a5d832090e137
                                                                                                                                                                                                                                          • Instruction ID: cedcd2fcecc0f3b639b4a60f8e705d841bf7c3ca6ff8c8b588c133afeb9fc770
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 35c9d41c65e7a6057b424292e649dab30af98cc9056b9a63245a5d832090e137
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4A219635B08A82A5EB58DF11E4509A933A0EB88B88FD84072DE2D877DDDF3CE556C700
                                                                                                                                                                                                                                          Function 00007FFDFA9942BC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                                                                                                                                          • String ID: a unicode character$argument 1$decimal
                                                                                                                                                                                                                                          • API String ID: 3545102714-2474051849
                                                                                                                                                                                                                                          • Opcode ID: 37a4153ce9cd5952ba336a7a13e7d13d1a4106d113bef46bdc421c90457116d1
                                                                                                                                                                                                                                          • Instruction ID: 800e383ba5eea90ce0473d84347d9137ea1f3be6941d621d993b3ef9aaa8f4cb
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 37a4153ce9cd5952ba336a7a13e7d13d1a4106d113bef46bdc421c90457116d1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F721D431B18A43A5EB588B22E5519A92364FB88B8CFC84072CA2D877DCCF2CD446C700
                                                                                                                                                                                                                                          Function 00007FF6D3B67D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                          • String ID: CONOUT$
                                                                                                                                                                                                                                          • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                          • Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                          • Instruction ID: 9410660c881c9baabd4cdb5053c2cba7ca1fde8448a73df5d6bf797f014774ce
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9611D621B19B4182E3508B12E84632DB7A0FBA9BE4F040235D99EDB795CF7CD4248780
                                                                                                                                                                                                                                          Function 00007FFDFA856B10 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 278COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700067944.00007FFDFA821000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FFDFA820000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700023786.00007FFDFA820000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700373108.00007FFDFA97B000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700453114.00007FFDFA980000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa820000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memcpy
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$API called with NULL prepared statement$API called with finalized prepared statement$misuse
                                                                                                                                                                                                                                          • API String ID: 3510742995-774319783
                                                                                                                                                                                                                                          • Opcode ID: c1f2e72d02041f634680d4dfe94196d23bd266405e708ce222b3484ffe9b10a2
                                                                                                                                                                                                                                          • Instruction ID: accfc79c2247d5e5dd338fc55cc35e284ce7c3b89335a132adaeae894f516ca7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c1f2e72d02041f634680d4dfe94196d23bd266405e708ce222b3484ffe9b10a2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DBE1A026F19BC586E7198B28C6106FC6360FBA9B58F189275DF9C13296EF78E1D58300
                                                                                                                                                                                                                                          Function 00007FF6D3B48ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B48EFD
                                                                                                                                                                                                                                          • K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B48F5A
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B49390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D3B445F4,00000000,00007FF6D3B41985), ref: 00007FF6D3B493C9
                                                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B48FE5
                                                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B49044
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B49055
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6D3B43FB1), ref: 00007FF6D3B4906A
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3462794448-0
                                                                                                                                                                                                                                          • Opcode ID: b9812aa4a412ff6f242132f81c88a7c8c76a4ef9029947ab8fd2a45bc25d6007
                                                                                                                                                                                                                                          • Instruction ID: 45a5577a98f946f7b1e25aa2da7c016f4a72fe09c5b22e96adb479d394c2431e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b9812aa4a412ff6f242132f81c88a7c8c76a4ef9029947ab8fd2a45bc25d6007
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC41A961B1A68181EA309B12A5022BEB3A4FF9ABD8F440136DFCDE7789DE3DD510C704
                                                                                                                                                                                                                                          Function 00007FFDFA7D1D30 Relevance: 9.1, APIs: 6, Instructions: 109COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3698825309.00007FFDFA7D1000.00000020.00000001.01000000.00000050.sdmp, Offset: 00007FFDFA7D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698771300.00007FFDFA7D0000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698872454.00007FFDFA7D3000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698924678.00007FFDFA7D4000.00000004.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699005000.00007FFDFA7D5000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7d0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _aligned_free_aligned_malloc$callocfree
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2511558924-0
                                                                                                                                                                                                                                          • Opcode ID: 8fb2105fd7c39bf321232f7441f6f1b7ebcf620c9448f78960a77339e4ca462d
                                                                                                                                                                                                                                          • Instruction ID: 7d0cdcfaa7c89704084ae15b5dfe4f5d9e2fd9022c7e1fa3cf41f126c170785b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8fb2105fd7c39bf321232f7441f6f1b7ebcf620c9448f78960a77339e4ca462d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CF413A66B09A4286EB19CF41E460A3873A1FF48B91F0845B1CE5D43BD8EF3CE8998300
                                                                                                                                                                                                                                          Function 00007FF6D3B490E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: GetCurrentProcess.KERNEL32 ref: 00007FF6D3B48590
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: OpenProcessToken.ADVAPI32 ref: 00007FF6D3B485A3
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: GetTokenInformation.ADVAPI32 ref: 00007FF6D3B485C8
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: GetLastError.KERNEL32 ref: 00007FF6D3B485D2
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: GetTokenInformation.ADVAPI32 ref: 00007FF6D3B48612
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6D3B4862E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B48570: CloseHandle.KERNEL32 ref: 00007FF6D3B48646
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF6D3B43C55), ref: 00007FF6D3B4916C
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF6D3B43C55), ref: 00007FF6D3B49175
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                          • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                          • Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                                                          • Instruction ID: 127dc0b82d7034c2555e8ca363469eb2034c68354435cfc525f0ed2be430beaf
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 62214F21A0A74251E610AB50E9163FEB260FFAA784F444037EA8DE7796DF3CD8658780
                                                                                                                                                                                                                                          Function 00007FF6D3B5B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B2D7
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B30D
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B33A
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B34B
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B35C
                                                                                                                                                                                                                                          • SetLastError.KERNEL32(?,?,?,00007FF6D3B54F11,?,?,?,?,00007FF6D3B5A48A,?,?,?,?,00007FF6D3B5718F), ref: 00007FF6D3B5B377
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
                                                                                                                                                                                                                                          • Instruction ID: 477b99f7bdf5c71ae0f0387dbd7b8600e6447a162b99a6b546f6a5ee379e9ad7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9811A121F0F64282FA58E721D54313DE6529F767B0F084336D8AEF7AD6DEACA5214700
                                                                                                                                                                                                                                          Function 00007FF6D3B42910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6D3B41B6A), ref: 00007FF6D3B4295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                          • Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                          • Instruction ID: e7c40c75f2823b0f672a1ca52d58f1a1a78d63c6c51a78453977a0b320abc0ed
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 15312822B1A68152E7109761A8426FEA394BF9A7D8F400133EECDE7746EF7CD556C700
                                                                                                                                                                                                                                          Function 00007FF6D3B42B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6D3B4918F,?,00007FF6D3B43C55), ref: 00007FF6D3B42BA0
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF6D3B42C2A
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                          • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                          • Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                          • Instruction ID: 4192ab8fe7c8db54048802c1304ebf6a0e6a2e5c1b5a4a21a5e21546e6dccd8c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E221D162B0AB4152E710DB55F8427AEB3A4FB99784F400136EA8DA775ADE3CD225C740
                                                                                                                                                                                                                                          Function 00007FF6D3B42710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6D3B41B99), ref: 00007FF6D3B42760
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                          • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                          • Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                          • Instruction ID: fb70a3b910aa856934e94e4aaf281a98830a0a45627bcaad1831bfa1dd9be5ff
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9121D132A0A78152E720DB51F8427EAA3A4FB993C4F400132EECCA765ADF7CD1558740
                                                                                                                                                                                                                                          Function 00007FFDFA994D58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
                                                                                                                                                                                                                                          • String ID: not a numeric character
                                                                                                                                                                                                                                          • API String ID: 1034370217-2058156748
                                                                                                                                                                                                                                          • Opcode ID: e94a4cbcbf0e5bcd60c879edbbe527308af40d50addda8a0dc073dd71fed3554
                                                                                                                                                                                                                                          • Instruction ID: f2badd7201f6c2dea758b542ec3d97a0eef3191dd3918d225f9bc454dfda15d8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e94a4cbcbf0e5bcd60c879edbbe527308af40d50addda8a0dc073dd71fed3554
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A2117825B1C942A1EB6E4B11A47087963E5AF8CB4CF9841F1C93E866DCDF2CF489C300
                                                                                                                                                                                                                                          Function 00007FFDFA994384 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
                                                                                                                                                                                                                                          • String ID: not a decimal
                                                                                                                                                                                                                                          • API String ID: 3750391552-3590249192
                                                                                                                                                                                                                                          • Opcode ID: 1cd0ce8ce41aec67d618eaf50ce9a381a57b186b45043069d79b570d0f92dffd
                                                                                                                                                                                                                                          • Instruction ID: 2743384b83787437ee3d301f4e83967dc05135d22abeb29fb84814b8191ce920
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1cd0ce8ce41aec67d618eaf50ce9a381a57b186b45043069d79b570d0f92dffd
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 25115411B18A42A1EB1D4B25E56493D6395AF8CB8CF8444B1DA6FC66D8EF2CE459C300
                                                                                                                                                                                                                                          Function 00007FFDFA99441C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Arg_ArgumentReadyUnicode_
                                                                                                                                                                                                                                          • String ID: a unicode character$argument$decomposition
                                                                                                                                                                                                                                          • API String ID: 1875788646-2471543666
                                                                                                                                                                                                                                          • Opcode ID: 8e092fff27016ad70a75c21de804b5fd7f142a4693611c384d04bc395b3b3e7a
                                                                                                                                                                                                                                          • Instruction ID: b497d60348cf4dd06695dde6b3b497cf1b6eafda8ab1ebbc90309beab0981ca3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e092fff27016ad70a75c21de804b5fd7f142a4693611c384d04bc395b3b3e7a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5601A260B08683A1EB58DB19A5609B523A0AF4DBD8FC41071D97F862DDDF3CD499C300
                                                                                                                                                                                                                                          Function 00007FFDFA9946E8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Arg_ArgumentReadyUnicode_
                                                                                                                                                                                                                                          • String ID: a unicode character$argument$east_asian_width
                                                                                                                                                                                                                                          • API String ID: 1875788646-3913127203
                                                                                                                                                                                                                                          • Opcode ID: 1cd4da9dc117a34be79d860a1371cb1431d82210e1bfc1e6159635a71f123b29
                                                                                                                                                                                                                                          • Instruction ID: c8ea061f6e3f9b91bc491c84819e93832db9db3cad614faddb82ab5502d09cef
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1cd4da9dc117a34be79d860a1371cb1431d82210e1bfc1e6159635a71f123b29
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D201A750B08647A1EB599B11A5609B52390AF4DB98FC45071D92E862DCDF2CD459C300
                                                                                                                                                                                                                                          Function 00007FFDFA992620 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Mem_$Capsule_Err_FreeMallocMemory
                                                                                                                                                                                                                                          • String ID: unicodedata._ucnhash_CAPI
                                                                                                                                                                                                                                          • API String ID: 3673501854-3989975041
                                                                                                                                                                                                                                          • Opcode ID: 9c8937bca7593cf83dc6e6686b6a5b89807f230b44c95862bfa962c91a770e15
                                                                                                                                                                                                                                          • Instruction ID: 264102dce380cb5ed7c0da76872842dbae613e1a82f155d6dca4834bf00f4637
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9c8937bca7593cf83dc6e6686b6a5b89807f230b44c95862bfa962c91a770e15
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7BF01D20B09B47B5FF594B11A46097662A8BF1C789FC81076C86E867ECEF3CE0488300
                                                                                                                                                                                                                                          Function 00007FF6D3B59A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                          • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                          • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                          • Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                          • Instruction ID: 180ad541187aa13c6bf12124995d716a8112acd3a3176dd6ba91158c138ac6c9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 27F0C861B0AB0681EB108B11E44673DA330EF9A7A0F440237C9AE991E4DF6CD054C750
                                                                                                                                                                                                                                          Function 00007FFDFA8BAB30 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700067944.00007FFDFA821000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FFDFA820000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700023786.00007FFDFA820000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700294834.00007FFDFA94E000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700373108.00007FFDFA97B000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700453114.00007FFDFA980000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa820000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memcpy
                                                                                                                                                                                                                                          • String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
                                                                                                                                                                                                                                          • API String ID: 3510742995-1299490920
                                                                                                                                                                                                                                          • Opcode ID: 2623641340c733b794af5866e5bcb4bdb6316ec65f5e7f2dcf12a73dcdb92bb2
                                                                                                                                                                                                                                          • Instruction ID: 423a0bdca35da5a30c62dc86ba5d4d4ce51350316a6b8249bc3a7b390c69b8c8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2623641340c733b794af5866e5bcb4bdb6316ec65f5e7f2dcf12a73dcdb92bb2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 80F1E122B29B8182EB588B15E464B7AB7A1FB44BD4F8442B2DE6D477D8DF7CE441C340
                                                                                                                                                                                                                                          Function 00007FF6D3B69368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _set_statfp
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1156100317-0
                                                                                                                                                                                                                                          • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction ID: 3d7f22b9e0394a92e499baaeb76e5e433ef05fbeb75d39c8d8c181e7fbda2f0d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5C118672D5EA0341FA641155E49337DB050AFBB370E040636EBEEFE2DBCE6C66614180
                                                                                                                                                                                                                                          Function 00007FF6D3B5B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FlsGetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B3AF
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B3CE
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B3F6
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B407
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF6D3B5A5A3,?,?,00000000,00007FF6D3B5A83E,?,?,?,?,?,00007FF6D3B5A7CA), ref: 00007FF6D3B5B418
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
                                                                                                                                                                                                                                          • Instruction ID: 0657d732bb32510ab97403e85e6999864a4037da08c765abbc5e8911bf6b0ad6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0011A221F0B64281F964E725D54317DE2419FA27B0F4C4336D8BDF6AC6DE6CE4624700
                                                                                                                                                                                                                                          Function 00007FF6D3B5B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
                                                                                                                                                                                                                                          • Instruction ID: fb5ee699dec7fb1acecc7a14ec969ac4050e5f227d434a26c9266f5acc1c77f5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC115A21E0B20781F999E661C41317DDA424F67330F0C4736D9BEFAAC2DD6DB4214B61
                                                                                                                                                                                                                                          Function 00007FF6D3B55FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: verbose
                                                                                                                                                                                                                                          • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                          • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction ID: 906b16ef87af5c4b245fa1e510a02e9b76ee39ec18552b0cb39b23cd7c0e1752
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8D913532B0A64689F7618E24D45237DB7A0AB62B94F486133DADDE33C5DF3DE8658300
                                                                                                                                                                                                                                          Function 00007FF6D3B5FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                          • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                          • Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                          • Instruction ID: c4330fc6d580fcf948131b2ab3ce6ff99c85d6b7f2b25a04cbd6b8657a3982d4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3819F73E0A246C5F7A55E29C20227CFEA0EB33B44F554037CA89F7AC5CE2DA8218701
                                                                                                                                                                                                                                          Function 00007FF6D3B4D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                          • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                          • Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                          • Instruction ID: a7096737d91810107e77bc91bd19d7b6fa52de67c2c04e653d40dc686263db76
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC51B032B1B6028ADB14CB15D145A3CB391EB69B9CF10813ADA8E97746DF7CE861C704
                                                                                                                                                                                                                                          Function 00007FF6D3B4F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm$csm
                                                                                                                                                                                                                                          • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                          • Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                          • Instruction ID: 8538ae5273ab2010acce74533ac338cf77ba398a8a5929a517cd60b463c1442c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5951863360924286EB748B65A04526CBBA0FB6AB98F144137DACD97B85CF3CE560C705
                                                                                                                                                                                                                                          Function 00007FF6D3B4EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                          • String ID: MOC$RCC
                                                                                                                                                                                                                                          • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                          • Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                          • Instruction ID: 9d4ace282c94e2b59cf74974ccd4ffd24cb06562bc5dc57a08255ab89a9a92dc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 68618233909BC585E7618B15E4413AEBBA0FB99798F044226EBDC53B55CF7CD1A0CB04
                                                                                                                                                                                                                                          Function 00007FF6D3B47E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(00000000,?,00007FF6D3B4352C,?,00000000,00007FF6D3B43F23), ref: 00007FF6D3B47F32
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectory
                                                                                                                                                                                                                                          • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                          • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                          • Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
                                                                                                                                                                                                                                          • Instruction ID: fd3d86969cd8b7030d98d8576f9107fd1577017d726ac8c0712edb20bbc0c756
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0331DA2171AAC545EA218B11E8133AEA354EF99BE4F440232EAFD977C9DF2CD615C704
                                                                                                                                                                                                                                          Function 00007FF6D3B42810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message
                                                                                                                                                                                                                                          • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                          • Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                          • Instruction ID: 472a5cf3cbeb8722649ae4b781667aeab79773fcdfe7806e5842a47b0e46b10b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4021BF62B09B4192E710DB55F4427AEB3A0EB99784F400136EA8DA765ADE3CD265C740
                                                                                                                                                                                                                                          Function 00007FFDFA991EF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • PyErr_SetString.PYTHON311(?,?,?,?,?,00007FFDFA991EDC), ref: 00007FFDFA993B6F
                                                                                                                                                                                                                                            • Part of subcall function 00007FFDFA991FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFA992008
                                                                                                                                                                                                                                            • Part of subcall function 00007FFDFA991FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFA992026
                                                                                                                                                                                                                                          • PyErr_Format.PYTHON311 ref: 00007FFDFA991F53
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Err_strncmp$FormatString
                                                                                                                                                                                                                                          • String ID: name too long$undefined character name '%s'
                                                                                                                                                                                                                                          • API String ID: 3882229318-4056717002
                                                                                                                                                                                                                                          • Opcode ID: 8b8c9c862c8556266a26c0415d30d38fd4fd6db163ae40366dde064f1277ed55
                                                                                                                                                                                                                                          • Instruction ID: bc4f85c968f7bf5d0d5276ec0478fd6de54316cc9bc6552bc0787968c13c1c69
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8b8c9c862c8556266a26c0415d30d38fd4fd6db163ae40366dde064f1277ed55
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A8111265B1894BE1EB448F14D4A49B96364FB8C78CFD00471CA2D862E8DF6DD54AC700
                                                                                                                                                                                                                                          Function 00007FFDFAAB1410 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Err_LongLong_String
                                                                                                                                                                                                                                          • String ID: Invalid lgblock$Invalid lgblock. Can be 0 or in range 16 to 24.
                                                                                                                                                                                                                                          • API String ID: 568964304-2070589380
                                                                                                                                                                                                                                          • Opcode ID: 98ac89e9ae3e119ae39c4b923ceb1be476487f23198bc6fec9af8334a5baf927
                                                                                                                                                                                                                                          • Instruction ID: 49d6717a0c1b3b9c1555e03495f325d84376c07956537db7ed3d19c420df3f7d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 98ac89e9ae3e119ae39c4b923ceb1be476487f23198bc6fec9af8334a5baf927
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 43F054E1F0C60781FB1D4715E464AB83290EF48788FD8D0B2D43D852D8DE5CD4DA8300
                                                                                                                                                                                                                                          Function 00007FFDFAAB1350 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Err_LongLong_String
                                                                                                                                                                                                                                          • String ID: Invalid quality$Invalid quality. Range is 0 to 11.
                                                                                                                                                                                                                                          • API String ID: 568964304-3078312006
                                                                                                                                                                                                                                          • Opcode ID: bf0f2c2d88753ce6f75839a482aaea8b1615882223bf6accab7f266c8a4c0845
                                                                                                                                                                                                                                          • Instruction ID: 7d63db32dfc32fa9debcfa1c20eee9c474c59f03ad81cba787639f949bc3ecdc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bf0f2c2d88753ce6f75839a482aaea8b1615882223bf6accab7f266c8a4c0845
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7AF0E5A1F08602C6F75D8B15D4A4A7833A0EF487D5FC8C0B1C82D466D8EF2C94DAC300
                                                                                                                                                                                                                                          Function 00007FFDFAAE0510 Relevance: 6.3, APIs: 4, Instructions: 321COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memmove$exit
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 987259897-0
                                                                                                                                                                                                                                          • Opcode ID: 79d9dcba4dee088979e62e56151a7632dd868efc27c5ebe9eaf823a5f0b8b74d
                                                                                                                                                                                                                                          • Instruction ID: d86aa377e43bdba320888a25747361d9bf284d6c9e536b6e394647cbd627dfa9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 79d9dcba4dee088979e62e56151a7632dd868efc27c5ebe9eaf823a5f0b8b74d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 16D19072709B8182DB288B16E55476EB3A5FB88BD4F058475CFAE17B88DF3CD4698310
                                                                                                                                                                                                                                          Function 00007FF6D3B5C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2718003287-0
                                                                                                                                                                                                                                          • Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                          • Instruction ID: 007295f1b2d19932f5c0172be5dc47b96591032668fe59c72c2293b41202fcb3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 16D11672B0AA4189E711CF65D4412BCB7B2FB66798B044236DE8DE7B89DF38D026C700
                                                                                                                                                                                                                                          Function 00007FFDFAAE9140 Relevance: 6.2, APIs: 4, Instructions: 227COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFDFAAE988A), ref: 00007FFDFAAE920A
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFDFAAE988A), ref: 00007FFDFAAE924F
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFDFAAE988A), ref: 00007FFDFAAE9294
                                                                                                                                                                                                                                          • memmove.VCRUNTIME140(00000000,?,?,00007FFDFAAE988A), ref: 00007FFDFAAE9355
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: log2$memmove
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3336697533-0
                                                                                                                                                                                                                                          • Opcode ID: 1680cdc6a483d2b4af0fd29261cfd8d16fc7ddb78b32cb5b10661259ba284ebb
                                                                                                                                                                                                                                          • Instruction ID: 5b092c1677810d191e329f7c65fff1593169401b3a47bd94df3b324b597fe8c3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1680cdc6a483d2b4af0fd29261cfd8d16fc7ddb78b32cb5b10661259ba284ebb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89B1E526B18F8185E7168F39D0507B9B364FF99784F14D332DB9E22695EF38E5968300
                                                                                                                                                                                                                                          Function 00007FFDFAAE8880 Relevance: 6.2, APIs: 4, Instructions: 227COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFDFAAE8FCA), ref: 00007FFDFAAE894A
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFDFAAE8FCA), ref: 00007FFDFAAE898F
                                                                                                                                                                                                                                          • log2.API-MS-WIN-CRT-MATH-L1-1-0(00000000,?,?,00007FFDFAAE8FCA), ref: 00007FFDFAAE89D4
                                                                                                                                                                                                                                          • memmove.VCRUNTIME140(00000000,?,?,00007FFDFAAE8FCA), ref: 00007FFDFAAE8A95
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: log2$memmove
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3336697533-0
                                                                                                                                                                                                                                          • Opcode ID: 37c08e7e4291ae7c0fd9f5e7d1ae2ed9a98bb0acaa0912484a1cbda665e6c135
                                                                                                                                                                                                                                          • Instruction ID: 0dc5194910a83e104b98178fb05a17057bebfff747930851bddbe2b16563fb87
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 37c08e7e4291ae7c0fd9f5e7d1ae2ed9a98bb0acaa0912484a1cbda665e6c135
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2DB1E522F18F8585E7168B3990507BEB364FF99784F149372DB9E23694DF38A996C200
                                                                                                                                                                                                                                          Function 00007FF6D3B5CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3B5CF4B), ref: 00007FF6D3B5D07C
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3B5CF4B), ref: 00007FF6D3B5D107
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 953036326-0
                                                                                                                                                                                                                                          • Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                          • Instruction ID: 5b780e0fedd5360abb6ab55b49325deaea709b1877f28af27e3490d8355b54ed
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8591D832F1A69185F7509F65D4422BDABA0BB66B88F14423BDE8EF7685CF38D452C700
                                                                                                                                                                                                                                          Function 00007FFDFA991FD0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: strncmp
                                                                                                                                                                                                                                          • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                                                                                                                          • API String ID: 1114863663-87138338
                                                                                                                                                                                                                                          • Opcode ID: 8de3eb989cf6c62dcbce841305c01691443b1373284778389dc9e239678f53b6
                                                                                                                                                                                                                                          • Instruction ID: 18caee6c9860997493acef81fb6ef2f352f49d27ab604cf9b2ccf0708e809864
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8de3eb989cf6c62dcbce841305c01691443b1373284778389dc9e239678f53b6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A6612832B1C64266F7688E19A860A7E7252FB88798FC44235EA7DC76DDEF3CD4058700
                                                                                                                                                                                                                                          Function 00007FFDFAB00740 Relevance: 6.2, APIs: 4, Instructions: 163COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memmove$exitmemset
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2725257846-0
                                                                                                                                                                                                                                          • Opcode ID: 7667acfe8cd979c61ef8322217f9533025dc7a57991cc5d72a4afbdb4d25e19c
                                                                                                                                                                                                                                          • Instruction ID: bcac50eb316c1043150bfffcc88f839687c3c5fb5c98bfbc818b36097a23f4f7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7667acfe8cd979c61ef8322217f9533025dc7a57991cc5d72a4afbdb4d25e19c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E0614D72708B9182EB69CF16E5547AA73A4FB48B84F888135DF9E47B98EF38D450C340
                                                                                                                                                                                                                                          Function 00007FFDFAAFFC90 Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memmove$exitmemset
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2725257846-0
                                                                                                                                                                                                                                          • Opcode ID: 23cfdeea8cd9a323e5b039c749b7dda14dfd5c35ac79cae9b21fed405305592a
                                                                                                                                                                                                                                          • Instruction ID: 6563be1e4b68d370f3572c2857b3ce408fb5b02ef7729609efe8785a0b839b0d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 23cfdeea8cd9a323e5b039c749b7dda14dfd5c35ac79cae9b21fed405305592a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C0514D72605B8182DB288F22E9547A9B3A4FB48B84F484535DFAE47B98DF38D095C344
                                                                                                                                                                                                                                          Function 00007FFDFAAE9CA0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memmove$exitmemset
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2725257846-0
                                                                                                                                                                                                                                          • Opcode ID: a32b4bb5653312606587a6e74c96ac44aa3f345004107e7812205a3e2226a543
                                                                                                                                                                                                                                          • Instruction ID: 8762f0728a485e31720e2ef2a271c1972791457967dafd04b77674231db1d85c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a32b4bb5653312606587a6e74c96ac44aa3f345004107e7812205a3e2226a543
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2341ED76B0475182DB189B07E094A2AB755FB85BD0F498236DEBD877D8DE3CE802C700
                                                                                                                                                                                                                                          Function 00007FFDFA070504 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3697193602.00007FFDF9AF1000.00000020.00000001.01000000.00000035.sdmp, Offset: 00007FFDF9AF0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697103357.00007FFDF9AF0000.00000002.00000001.01000000.00000035.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698030689.00007FFDFA08A000.00000002.00000001.01000000.00000035.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698328456.00007FFDFA20F000.00000004.00000001.01000000.00000035.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698397377.00007FFDFA210000.00000008.00000001.01000000.00000035.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698453074.00007FFDFA211000.00000004.00000001.01000000.00000035.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698503378.00007FFDFA219000.00000008.00000001.01000000.00000035.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698551130.00007FFDFA21E000.00000004.00000001.01000000.00000035.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698608929.00007FFDFA222000.00000002.00000001.01000000.00000035.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdf9af0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                                                          • Opcode ID: beceb9d99cd86d4124f4c4e6ac7526b31cb8b8c9be067b383abdb293bdb3ff0d
                                                                                                                                                                                                                                          • Instruction ID: 79ad4b9095da8e38e865f6f2d6244a345a6d0963182aa4639dda976292035d0d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: beceb9d99cd86d4124f4c4e6ac7526b31cb8b8c9be067b383abdb293bdb3ff0d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FE112E22B15F0689EB00CF64EC646B933A4F759B58F441E35DA7D86BA8DF7CD1548340
                                                                                                                                                                                                                                          Function 00007FF6D3B4D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                                                          • Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                          • Instruction ID: c8d645bf0715212bee8c8fa2ea62ca705ccc2bb15b5c0053190f5a7c4438fead
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 71115122B15F0589EB00CF61E8562BD73B4FB2A758F040E36DA5D96764DF7CD1648780
                                                                                                                                                                                                                                          Function 00007FFDFAAE8460 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 252COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: exitmemmove
                                                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                                                          • API String ID: 1790971451-2766056989
                                                                                                                                                                                                                                          • Opcode ID: fb4b732d7ba2ad41e51b609ce057e87b5d2821d6290d3fdf268689399a755141
                                                                                                                                                                                                                                          • Instruction ID: 7609560eef8002db0cbf76fe61183a84f2d503bab66f266e4059e79f718e6348
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fb4b732d7ba2ad41e51b609ce057e87b5d2821d6290d3fdf268689399a755141
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6FB15A26708BC482DB24CB1AE5587AAB3A4F788BC4F189265DF8D17B49DF3CE585C700
                                                                                                                                                                                                                                          Function 00007FF6D3B65B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: ?
                                                                                                                                                                                                                                          • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                          • Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
                                                                                                                                                                                                                                          • Instruction ID: 513fa44ea400b37ebce002300013dfad9ff59daba7d07b185637c50e010441c9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C1411B12A0A38246FB609B25D54237DE750EBA2BA4F144237EFDC9AAD6DF3CD4718740
                                                                                                                                                                                                                                          Function 00007FF6D3B59014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D3B59046
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A95E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF6D3B5A948: GetLastError.KERNEL32(?,?,?,00007FF6D3B62D22,?,?,?,00007FF6D3B62D5F,?,?,00000000,00007FF6D3B63225,?,?,?,00007FF6D3B63157), ref: 00007FF6D3B5A968
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6D3B4CBA5), ref: 00007FF6D3B59064
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: C:\Users\user\Desktop\Payload.exe
                                                                                                                                                                                                                                          • API String ID: 3580290477-1542176811
                                                                                                                                                                                                                                          • Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
                                                                                                                                                                                                                                          • Instruction ID: 06d8af59019e30d77279e2371079e0de1a2ca4e0df646733bd88af7732c5ff45
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1341B136A0AB1285EB55EF25D4420BCB7A4EF667D0B454037E98EE7B85DF3CE4A18300
                                                                                                                                                                                                                                          Function 00007FFDFAADA300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: log2
                                                                                                                                                                                                                                          • String ID: Tg]@
                                                                                                                                                                                                                                          • API String ID: 4048861018-1367013573
                                                                                                                                                                                                                                          • Opcode ID: 314978e01d248754fc8a1f8367cd94a51ede3c6cab710bddc8371ba00d0dbb51
                                                                                                                                                                                                                                          • Instruction ID: 02c1c8fbd9b1b6e546d3f6572957f94bc31247f6fd30cda4043eecf2a934ee8f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 314978e01d248754fc8a1f8367cd94a51ede3c6cab710bddc8371ba00d0dbb51
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EC412B31B25B498AD7168F36D010AADB651FF45B84F148331EA5B277D8EB39E193D600
                                                                                                                                                                                                                                          Function 00007FF6D3B5CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                          • String ID: U
                                                                                                                                                                                                                                          • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                          • Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                          • Instruction ID: 3448119a604d8277742232b120e6445e4919e1a627a9d14c9be17b46a83395a7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EE41B322B1AA4181DB208F25E4453BDA7A1FBAAB84F544132EE8DD7798EF7CD451C740
                                                                                                                                                                                                                                          Function 00007FFDFA7D2AF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3698825309.00007FFDFA7D1000.00000020.00000001.01000000.00000050.sdmp, Offset: 00007FFDFA7D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698771300.00007FFDFA7D0000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698872454.00007FFDFA7D3000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3698924678.00007FFDFA7D4000.00000004.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3699005000.00007FFDFA7D5000.00000002.00000001.01000000.00000050.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa7d0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _wassert
                                                                                                                                                                                                                                          • String ID: (idx>=1) && (idx<=10)$src/AESNI.c
                                                                                                                                                                                                                                          • API String ID: 3234217646-2495715787
                                                                                                                                                                                                                                          • Opcode ID: f34cea9cfd06ae8d0bacecc527501edc0e611be2f02bd286901079fb247b3b81
                                                                                                                                                                                                                                          • Instruction ID: fc9ad2c13d7c1420672c6e8890028a03aae6deabb91eabd195f3af0dd872ce5a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f34cea9cfd06ae8d0bacecc527501edc0e611be2f02bd286901079fb247b3b81
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A921563390D3C14BD7034F3694A949C7FB0EB96B50B99C2AAC39593646EA9C98CBC711
                                                                                                                                                                                                                                          Function 00007FF6D3B5F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentDirectory
                                                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                                                          • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                          • Opcode ID: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
                                                                                                                                                                                                                                          • Instruction ID: 81003fbb3fcfd73f5379e9ff3191e50ee50b43c79208ade86fe2f4345979bc8a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 16210663A0A64181EB20DB11D04627DF7B1FBAAB44F454036D6CDA3684CF7CD955CB41
                                                                                                                                                                                                                                          Function 00007FF6D3B4FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                          • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                          • Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                          • Instruction ID: dc58035478c4e49ae7882edd81da0f586827acb2767b234dd6805746686697e8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 12114C32609B8182EB218F15E40025EBBE4FB99B88F184231DACD57765DF3CC561CB40
                                                                                                                                                                                                                                          Function 00007FF6D3B6073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3696797206.00007FF6D3B41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D3B40000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696738108.00007FF6D3B40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696855699.00007FF6D3B6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3696911101.00007FF6D3B81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3697016730.00007FF6D3B84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff6d3b40000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                                                          • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                          • Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                          • Instruction ID: fb2e656530deb4e387ae7583ebf220f36d3d68b5385d8c9440f3df77e1cc15b4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B301A76291D20386F7219F61946327EB3A0EF6B744F840037D5CDE6686DF3CD5248B54
                                                                                                                                                                                                                                          Function 00007FFDFA994C08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: String$Err_FromUnicode_
                                                                                                                                                                                                                                          • String ID: no such name
                                                                                                                                                                                                                                          • API String ID: 3678473424-4211486178
                                                                                                                                                                                                                                          • Opcode ID: 0bad81046192c5090e63041fc1c0adfcc3ec090d4373e4d8dfd61f48ff6f657e
                                                                                                                                                                                                                                          • Instruction ID: 5df9d6f2be3bf60edbc7981bd64a439c53fc6e270fa4c51da150e894af04d4e0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0bad81046192c5090e63041fc1c0adfcc3ec090d4373e4d8dfd61f48ff6f657e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 40016731718946A1FB659B11E860BB63354BF9CB4CF800071DE5E8A7D8EF2CE109C700
                                                                                                                                                                                                                                          Function 00007FFDFAAB12F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3701879894.00007FFDFAAB1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701807923.00007FFDFAAB0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702072980.00007FFDFAB05000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702488717.00007FFDFAB77000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3702570414.00007FFDFAB78000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfaab0000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Err_LongLong_String
                                                                                                                                                                                                                                          • String ID: Invalid mode
                                                                                                                                                                                                                                          • API String ID: 568964304-431149109
                                                                                                                                                                                                                                          • Opcode ID: 2e3b143024fffb948b6d36cb644d747681586ed00adecaaa304b2e3236bd7830
                                                                                                                                                                                                                                          • Instruction ID: 030f1c0418e37b9655f9b96cc24358ee2286f84326c6ca3b3c16c2026e5e2468
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2e3b143024fffb948b6d36cb644d747681586ed00adecaaa304b2e3236bd7830
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4F065A1F0864681F7595725E46867C33D0EF48B95FD894F1C53D86AD8EE1CD4DAC300
                                                                                                                                                                                                                                          Function 00007FFDFA9925B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _PyObject_GC_New.PYTHON311(?,?,00000000,00007FFDFA992533), ref: 00007FFDFA9925B6
                                                                                                                                                                                                                                          • PyObject_GC_Track.PYTHON311(?,?,00000000,00007FFDFA992533), ref: 00007FFDFA9925E8
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000001.00000002.3700578727.00007FFDFA991000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700520539.00007FFDFA990000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA995000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFA9F2000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA3E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA41000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAA46000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3700629261.00007FFDFAAA0000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701613876.00007FFDFAAA3000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000001.00000002.3701717290.00007FFDFAAA5000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfa990000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Object_$Track
                                                                                                                                                                                                                                          • String ID: 3.2.0
                                                                                                                                                                                                                                          • API String ID: 16854473-1786766648
                                                                                                                                                                                                                                          • Opcode ID: 767dd7ab98994f43239e4e329e749c2ad7475791c86a6fb4d160e6b955e6c056
                                                                                                                                                                                                                                          • Instruction ID: da6cbaec9f3cdd67df9ff72ee8981d53c29e9637c2d9bcea923fd0627528b7d1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 767dd7ab98994f43239e4e329e749c2ad7475791c86a6fb4d160e6b955e6c056
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8FE0ED24B05B06A5FB198B11E4A04A933A8BF0C708FD40175CD6D823A8EF3DE168C240

                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                          Execution Coverage:9.6%
                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                          Signature Coverage:0%
                                                                                                                                                                                                                                          Total number of Nodes:2000
                                                                                                                                                                                                                                          Total number of Limit Nodes:35
                                                                                                                                                                                                                                          execution_graph 20099 7ff71b42ad69 20102 7ff71b415478 LeaveCriticalSection 20099->20102 19409 7ff71b40bae0 19410 7ff71b40bb0e 19409->19410 19411 7ff71b40baf5 19409->19411 19411->19410 19413 7ff71b41d5fc 12 API calls 19411->19413 19412 7ff71b40bb6e 19413->19412 20413 7ff71b42abe3 20414 7ff71b42abf3 20413->20414 20417 7ff71b415478 LeaveCriticalSection 20414->20417 16916 7ff71b41f98c 16917 7ff71b41fb7e 16916->16917 16919 7ff71b41f9ce _isindst 16916->16919 16918 7ff71b414f08 _get_daylight 11 API calls 16917->16918 16936 7ff71b41fb6e 16918->16936 16919->16917 16922 7ff71b41fa4e _isindst 16919->16922 16920 7ff71b40c550 _log10_special 8 API calls 16921 7ff71b41fb99 16920->16921 16937 7ff71b426194 16922->16937 16927 7ff71b41fbaa 16928 7ff71b41a900 _isindst 17 API calls 16927->16928 16931 7ff71b41fbbe 16928->16931 16934 7ff71b41faab 16934->16936 16961 7ff71b4261d8 16934->16961 16936->16920 16938 7ff71b4261a3 16937->16938 16941 7ff71b41fa6c 16937->16941 16968 7ff71b4202d8 EnterCriticalSection 16938->16968 16943 7ff71b425598 16941->16943 16944 7ff71b41fa81 16943->16944 16945 7ff71b4255a1 16943->16945 16944->16927 16949 7ff71b4255c8 16944->16949 16946 7ff71b414f08 _get_daylight 11 API calls 16945->16946 16947 7ff71b4255a6 16946->16947 16948 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16947->16948 16948->16944 16950 7ff71b41fa92 16949->16950 16951 7ff71b4255d1 16949->16951 16950->16927 16955 7ff71b4255f8 16950->16955 16952 7ff71b414f08 _get_daylight 11 API calls 16951->16952 16953 7ff71b4255d6 16952->16953 16954 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16953->16954 16954->16950 16956 7ff71b425601 16955->16956 16958 7ff71b41faa3 16955->16958 16957 7ff71b414f08 _get_daylight 11 API calls 16956->16957 16959 7ff71b425606 16957->16959 16958->16927 16958->16934 16960 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16959->16960 16960->16958 16969 7ff71b4202d8 EnterCriticalSection 16961->16969 20427 7ff71b415410 20428 7ff71b41541b 20427->20428 20436 7ff71b41f2a4 20428->20436 20449 7ff71b4202d8 EnterCriticalSection 20436->20449 20450 7ff71b42adfe 20451 7ff71b42ae17 20450->20451 20452 7ff71b42ae0d 20450->20452 20454 7ff71b420338 LeaveCriticalSection 20452->20454 16706 7ff71b415628 16707 7ff71b41565f 16706->16707 16708 7ff71b415642 16706->16708 16707->16708 16710 7ff71b415672 CreateFileW 16707->16710 16757 7ff71b414ee8 16708->16757 16712 7ff71b4156dc 16710->16712 16713 7ff71b4156a6 16710->16713 16760 7ff71b415c04 16712->16760 16731 7ff71b41577c GetFileType 16713->16731 16714 7ff71b414f08 _get_daylight 11 API calls 16717 7ff71b41564f 16714->16717 16722 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16717->16722 16720 7ff71b415710 16781 7ff71b4159c4 16720->16781 16721 7ff71b4156e5 16725 7ff71b414e7c _fread_nolock 11 API calls 16721->16725 16727 7ff71b41565a 16722->16727 16723 7ff71b4156bb CloseHandle 16723->16727 16724 7ff71b4156d1 CloseHandle 16724->16727 16730 7ff71b4156ef 16725->16730 16730->16727 16732 7ff71b415887 16731->16732 16733 7ff71b4157ca 16731->16733 16735 7ff71b41588f 16732->16735 16736 7ff71b4158b1 16732->16736 16734 7ff71b4157f6 GetFileInformationByHandle 16733->16734 16738 7ff71b415b00 21 API calls 16733->16738 16739 7ff71b41581f 16734->16739 16740 7ff71b4158a2 GetLastError 16734->16740 16735->16740 16741 7ff71b415893 16735->16741 16737 7ff71b4158d4 PeekNamedPipe 16736->16737 16755 7ff71b415872 16736->16755 16737->16755 16747 7ff71b4157e4 16738->16747 16743 7ff71b4159c4 51 API calls 16739->16743 16742 7ff71b414e7c _fread_nolock 11 API calls 16740->16742 16744 7ff71b414f08 _get_daylight 11 API calls 16741->16744 16742->16755 16745 7ff71b41582a 16743->16745 16744->16755 16798 7ff71b415924 16745->16798 16746 7ff71b40c550 _log10_special 8 API calls 16749 7ff71b4156b4 16746->16749 16747->16734 16747->16755 16749->16723 16749->16724 16751 7ff71b415924 10 API calls 16752 7ff71b415849 16751->16752 16753 7ff71b415924 10 API calls 16752->16753 16754 7ff71b41585a 16753->16754 16754->16755 16756 7ff71b414f08 _get_daylight 11 API calls 16754->16756 16755->16746 16756->16755 16758 7ff71b41b2c8 _get_daylight 11 API calls 16757->16758 16759 7ff71b414ef1 16758->16759 16759->16714 16761 7ff71b415c3a 16760->16761 16762 7ff71b414f08 _get_daylight 11 API calls 16761->16762 16780 7ff71b415cd2 __std_exception_copy 16761->16780 16764 7ff71b415c4c 16762->16764 16763 7ff71b40c550 _log10_special 8 API calls 16765 7ff71b4156e1 16763->16765 16766 7ff71b414f08 _get_daylight 11 API calls 16764->16766 16765->16720 16765->16721 16767 7ff71b415c54 16766->16767 16805 7ff71b417e08 16767->16805 16769 7ff71b415c69 16770 7ff71b415c7b 16769->16770 16771 7ff71b415c71 16769->16771 16773 7ff71b414f08 _get_daylight 11 API calls 16770->16773 16772 7ff71b414f08 _get_daylight 11 API calls 16771->16772 16777 7ff71b415c76 16772->16777 16774 7ff71b415c80 16773->16774 16775 7ff71b414f08 _get_daylight 11 API calls 16774->16775 16774->16780 16776 7ff71b415c8a 16775->16776 16778 7ff71b417e08 45 API calls 16776->16778 16779 7ff71b415cc4 GetDriveTypeW 16777->16779 16777->16780 16778->16777 16779->16780 16780->16763 16782 7ff71b4159ec 16781->16782 16790 7ff71b41571d 16782->16790 16899 7ff71b41f724 16782->16899 16784 7ff71b415a80 16785 7ff71b41f724 51 API calls 16784->16785 16784->16790 16786 7ff71b415a93 16785->16786 16787 7ff71b41f724 51 API calls 16786->16787 16786->16790 16788 7ff71b415aa6 16787->16788 16789 7ff71b41f724 51 API calls 16788->16789 16788->16790 16789->16790 16791 7ff71b415b00 16790->16791 16792 7ff71b415b1a 16791->16792 16793 7ff71b415b51 16792->16793 16794 7ff71b415b2a 16792->16794 16796 7ff71b41f5b8 21 API calls 16793->16796 16795 7ff71b415b3a 16794->16795 16797 7ff71b414e7c _fread_nolock 11 API calls 16794->16797 16795->16730 16796->16795 16797->16795 16799 7ff71b41594d FileTimeToSystemTime 16798->16799 16800 7ff71b415940 16798->16800 16801 7ff71b415961 SystemTimeToTzSpecificLocalTime 16799->16801 16803 7ff71b415948 16799->16803 16800->16799 16800->16803 16801->16803 16802 7ff71b40c550 _log10_special 8 API calls 16804 7ff71b415839 16802->16804 16803->16802 16804->16751 16806 7ff71b417e92 16805->16806 16807 7ff71b417e24 16805->16807 16842 7ff71b4207c0 16806->16842 16807->16806 16809 7ff71b417e29 16807->16809 16810 7ff71b417e5e 16809->16810 16811 7ff71b417e41 16809->16811 16825 7ff71b417c4c GetFullPathNameW 16810->16825 16817 7ff71b417bd8 GetFullPathNameW 16811->16817 16816 7ff71b417e56 __std_exception_copy 16816->16769 16818 7ff71b417bfe GetLastError 16817->16818 16819 7ff71b417c14 16817->16819 16820 7ff71b414e7c _fread_nolock 11 API calls 16818->16820 16822 7ff71b414f08 _get_daylight 11 API calls 16819->16822 16824 7ff71b417c10 16819->16824 16821 7ff71b417c0b 16820->16821 16823 7ff71b414f08 _get_daylight 11 API calls 16821->16823 16822->16824 16823->16824 16824->16816 16826 7ff71b417c7f GetLastError 16825->16826 16831 7ff71b417c95 __std_exception_copy 16825->16831 16827 7ff71b414e7c _fread_nolock 11 API calls 16826->16827 16828 7ff71b417c8c 16827->16828 16830 7ff71b414f08 _get_daylight 11 API calls 16828->16830 16829 7ff71b417c91 16833 7ff71b417d24 16829->16833 16830->16829 16831->16829 16832 7ff71b417cef GetFullPathNameW 16831->16832 16832->16826 16832->16829 16834 7ff71b417d98 memcpy_s 16833->16834 16837 7ff71b417d4d __scrt_get_show_window_mode 16833->16837 16834->16816 16835 7ff71b417d81 16836 7ff71b414f08 _get_daylight 11 API calls 16835->16836 16841 7ff71b417d86 16836->16841 16837->16834 16837->16835 16839 7ff71b417dba 16837->16839 16838 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16838->16834 16839->16834 16840 7ff71b414f08 _get_daylight 11 API calls 16839->16840 16840->16841 16841->16838 16845 7ff71b4205d0 16842->16845 16846 7ff71b4205fb 16845->16846 16847 7ff71b420612 16845->16847 16848 7ff71b414f08 _get_daylight 11 API calls 16846->16848 16849 7ff71b420637 16847->16849 16850 7ff71b420616 16847->16850 16865 7ff71b420600 16848->16865 16883 7ff71b41f5b8 16849->16883 16871 7ff71b42073c 16850->16871 16854 7ff71b42063c 16859 7ff71b4206e1 16854->16859 16866 7ff71b420663 16854->16866 16855 7ff71b42061f 16857 7ff71b414ee8 _fread_nolock 11 API calls 16855->16857 16856 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16870 7ff71b42060b __std_exception_copy 16856->16870 16858 7ff71b420624 16857->16858 16861 7ff71b414f08 _get_daylight 11 API calls 16858->16861 16859->16846 16862 7ff71b4206e9 16859->16862 16860 7ff71b40c550 _log10_special 8 API calls 16864 7ff71b420731 16860->16864 16861->16865 16863 7ff71b417bd8 13 API calls 16862->16863 16863->16870 16864->16816 16865->16856 16867 7ff71b417c4c 14 API calls 16866->16867 16868 7ff71b4206a7 16867->16868 16869 7ff71b417d24 37 API calls 16868->16869 16868->16870 16869->16870 16870->16860 16872 7ff71b420786 16871->16872 16873 7ff71b420756 16871->16873 16874 7ff71b420771 16872->16874 16875 7ff71b420791 GetDriveTypeW 16872->16875 16876 7ff71b414ee8 _fread_nolock 11 API calls 16873->16876 16879 7ff71b40c550 _log10_special 8 API calls 16874->16879 16875->16874 16877 7ff71b42075b 16876->16877 16878 7ff71b414f08 _get_daylight 11 API calls 16877->16878 16880 7ff71b420766 16878->16880 16881 7ff71b42061b 16879->16881 16882 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16880->16882 16881->16854 16881->16855 16882->16874 16897 7ff71b42a4d0 16883->16897 16886 7ff71b41f62c 16888 7ff71b41eb98 _get_daylight 11 API calls 16886->16888 16887 7ff71b41f605 16889 7ff71b40c550 _log10_special 8 API calls 16887->16889 16890 7ff71b41f63b 16888->16890 16891 7ff71b41f699 16889->16891 16892 7ff71b41f654 16890->16892 16893 7ff71b41f645 GetCurrentDirectoryW 16890->16893 16891->16854 16894 7ff71b414f08 _get_daylight 11 API calls 16892->16894 16893->16892 16895 7ff71b41f659 16893->16895 16894->16895 16896 7ff71b41a948 __free_lconv_num 11 API calls 16895->16896 16896->16887 16898 7ff71b41f5ee GetCurrentDirectoryW 16897->16898 16898->16886 16898->16887 16900 7ff71b41f731 16899->16900 16904 7ff71b41f755 16899->16904 16901 7ff71b41f736 16900->16901 16900->16904 16903 7ff71b414f08 _get_daylight 11 API calls 16901->16903 16902 7ff71b41f78f 16905 7ff71b414f08 _get_daylight 11 API calls 16902->16905 16907 7ff71b41f73b 16903->16907 16904->16902 16906 7ff71b41f7ae 16904->16906 16908 7ff71b41f794 16905->16908 16909 7ff71b414f4c 45 API calls 16906->16909 16910 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16907->16910 16911 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16908->16911 16914 7ff71b41f7bb 16909->16914 16912 7ff71b41f746 16910->16912 16913 7ff71b41f79f 16911->16913 16912->16784 16913->16784 16914->16913 16915 7ff71b4204dc 51 API calls 16914->16915 16915->16914 19937 7ff71b4216b0 19948 7ff71b4273e4 19937->19948 19949 7ff71b4273f1 19948->19949 19950 7ff71b41a948 __free_lconv_num 11 API calls 19949->19950 19951 7ff71b42740d 19949->19951 19950->19949 19952 7ff71b41a948 __free_lconv_num 11 API calls 19951->19952 19953 7ff71b4216b9 19951->19953 19952->19951 19954 7ff71b4202d8 EnterCriticalSection 19953->19954 20206 7ff71b41c520 20217 7ff71b4202d8 EnterCriticalSection 20206->20217 15895 7ff71b4208c8 15896 7ff71b4208ec 15895->15896 15900 7ff71b4208fc 15895->15900 16046 7ff71b414f08 15896->16046 15898 7ff71b4208f1 15899 7ff71b420bdc 15901 7ff71b414f08 _get_daylight 11 API calls 15899->15901 15900->15899 15902 7ff71b42091e 15900->15902 15904 7ff71b420be1 15901->15904 15903 7ff71b42093f 15902->15903 16049 7ff71b420f84 15902->16049 15907 7ff71b4209b1 15903->15907 15909 7ff71b420965 15903->15909 15916 7ff71b4209a5 15903->15916 15906 7ff71b41a948 __free_lconv_num 11 API calls 15904->15906 15906->15898 15911 7ff71b41eb98 _get_daylight 11 API calls 15907->15911 15924 7ff71b420974 15907->15924 15908 7ff71b420a5e 15920 7ff71b420a7b 15908->15920 15925 7ff71b420acd 15908->15925 16064 7ff71b4196c0 15909->16064 15913 7ff71b4209c7 15911->15913 15917 7ff71b41a948 __free_lconv_num 11 API calls 15913->15917 15916->15908 15916->15924 16076 7ff71b42712c 15916->16076 15926 7ff71b4209d5 15917->15926 15918 7ff71b42098d 15918->15916 15923 7ff71b420f84 45 API calls 15918->15923 15919 7ff71b42096f 15921 7ff71b414f08 _get_daylight 11 API calls 15919->15921 15922 7ff71b41a948 __free_lconv_num 11 API calls 15920->15922 15921->15924 15929 7ff71b420a84 15922->15929 15923->15916 16070 7ff71b41a948 15924->16070 15925->15924 15927 7ff71b4233dc 40 API calls 15925->15927 15926->15916 15926->15924 15930 7ff71b41eb98 _get_daylight 11 API calls 15926->15930 15928 7ff71b420b0a 15927->15928 15931 7ff71b41a948 __free_lconv_num 11 API calls 15928->15931 15938 7ff71b420a89 15929->15938 16112 7ff71b4233dc 15929->16112 15933 7ff71b4209f7 15930->15933 15934 7ff71b420b14 15931->15934 15937 7ff71b41a948 __free_lconv_num 11 API calls 15933->15937 15934->15924 15934->15938 15935 7ff71b420bd0 15940 7ff71b41a948 __free_lconv_num 11 API calls 15935->15940 15936 7ff71b420ab5 15939 7ff71b41a948 __free_lconv_num 11 API calls 15936->15939 15937->15916 15938->15935 15938->15938 16026 7ff71b41eb98 15938->16026 15939->15938 15940->15898 15943 7ff71b420b69 16033 7ff71b41a4a4 15943->16033 15944 7ff71b420b60 15945 7ff71b41a948 __free_lconv_num 11 API calls 15944->15945 15948 7ff71b420b67 15945->15948 15953 7ff71b41a948 __free_lconv_num 11 API calls 15948->15953 15949 7ff71b420c0b 16042 7ff71b41a900 IsProcessorFeaturePresent 15949->16042 15950 7ff71b420b80 16121 7ff71b427244 15950->16121 15953->15898 15956 7ff71b420bc8 15961 7ff71b41a948 __free_lconv_num 11 API calls 15956->15961 15957 7ff71b420ba7 15959 7ff71b414f08 _get_daylight 11 API calls 15957->15959 15962 7ff71b420bac 15959->15962 15961->15935 15965 7ff71b41a948 __free_lconv_num 11 API calls 15962->15965 15965->15948 16032 7ff71b41eba9 _get_daylight 16026->16032 16027 7ff71b41ebfa 16029 7ff71b414f08 _get_daylight 10 API calls 16027->16029 16028 7ff71b41ebde HeapAlloc 16030 7ff71b41ebf8 16028->16030 16028->16032 16029->16030 16030->15943 16030->15944 16032->16027 16032->16028 16140 7ff71b423590 16032->16140 16034 7ff71b41a4b1 16033->16034 16037 7ff71b41a4bb 16033->16037 16034->16037 16040 7ff71b41a4d6 16034->16040 16035 7ff71b414f08 _get_daylight 11 API calls 16036 7ff71b41a4c2 16035->16036 16149 7ff71b41a8e0 16036->16149 16037->16035 16039 7ff71b41a4ce 16039->15949 16039->15950 16040->16039 16041 7ff71b414f08 _get_daylight 11 API calls 16040->16041 16041->16036 16043 7ff71b41a913 16042->16043 16211 7ff71b41a614 16043->16211 16233 7ff71b41b2c8 GetLastError 16046->16233 16048 7ff71b414f11 16048->15898 16050 7ff71b420fa1 16049->16050 16051 7ff71b420fb9 16049->16051 16050->15903 16052 7ff71b41eb98 _get_daylight 11 API calls 16051->16052 16059 7ff71b420fdd 16052->16059 16053 7ff71b421062 16250 7ff71b41a504 16053->16250 16055 7ff71b42103e 16057 7ff71b41a948 __free_lconv_num 11 API calls 16055->16057 16057->16050 16058 7ff71b41eb98 _get_daylight 11 API calls 16058->16059 16059->16053 16059->16055 16059->16058 16060 7ff71b41a948 __free_lconv_num 11 API calls 16059->16060 16061 7ff71b41a4a4 __std_exception_copy 37 API calls 16059->16061 16062 7ff71b42104d 16059->16062 16060->16059 16061->16059 16063 7ff71b41a900 _isindst 17 API calls 16062->16063 16063->16053 16065 7ff71b4196d0 16064->16065 16067 7ff71b4196d9 16064->16067 16065->16067 16316 7ff71b419198 16065->16316 16067->15918 16067->15919 16071 7ff71b41a94d RtlFreeHeap 16070->16071 16072 7ff71b41a97c 16070->16072 16071->16072 16073 7ff71b41a968 GetLastError 16071->16073 16072->15898 16074 7ff71b41a975 __free_lconv_num 16073->16074 16075 7ff71b414f08 _get_daylight 9 API calls 16074->16075 16075->16072 16077 7ff71b427139 16076->16077 16078 7ff71b426254 16076->16078 16079 7ff71b414f4c 45 API calls 16077->16079 16080 7ff71b426261 16078->16080 16083 7ff71b426297 16078->16083 16081 7ff71b42716d 16079->16081 16082 7ff71b414f08 _get_daylight 11 API calls 16080->16082 16096 7ff71b426208 16080->16096 16085 7ff71b427172 16081->16085 16089 7ff71b427183 16081->16089 16092 7ff71b42719a 16081->16092 16086 7ff71b42626b 16082->16086 16084 7ff71b4262c1 16083->16084 16088 7ff71b4262e6 16083->16088 16087 7ff71b414f08 _get_daylight 11 API calls 16084->16087 16085->15916 16090 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16086->16090 16091 7ff71b4262c6 16087->16091 16097 7ff71b414f4c 45 API calls 16088->16097 16103 7ff71b4262d1 16088->16103 16093 7ff71b414f08 _get_daylight 11 API calls 16089->16093 16094 7ff71b426276 16090->16094 16095 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16091->16095 16099 7ff71b4271a4 16092->16099 16100 7ff71b4271b6 16092->16100 16098 7ff71b427188 16093->16098 16094->15916 16095->16103 16096->15916 16097->16103 16104 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16098->16104 16105 7ff71b414f08 _get_daylight 11 API calls 16099->16105 16101 7ff71b4271c7 16100->16101 16102 7ff71b4271de 16100->16102 16608 7ff71b4262a4 16101->16608 16617 7ff71b428f4c 16102->16617 16103->15916 16104->16085 16106 7ff71b4271a9 16105->16106 16109 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16106->16109 16109->16085 16111 7ff71b414f08 _get_daylight 11 API calls 16111->16085 16113 7ff71b42341b 16112->16113 16114 7ff71b4233fe 16112->16114 16116 7ff71b423425 16113->16116 16657 7ff71b427c38 16113->16657 16114->16113 16115 7ff71b42340c 16114->16115 16117 7ff71b414f08 _get_daylight 11 API calls 16115->16117 16664 7ff71b427c74 16116->16664 16120 7ff71b423411 __scrt_get_show_window_mode 16117->16120 16120->15936 16122 7ff71b414f4c 45 API calls 16121->16122 16123 7ff71b4272aa 16122->16123 16126 7ff71b4272b8 16123->16126 16676 7ff71b41ef24 16123->16676 16679 7ff71b4154ac 16126->16679 16128 7ff71b4273a4 16131 7ff71b4273b5 16128->16131 16132 7ff71b41a948 __free_lconv_num 11 API calls 16128->16132 16129 7ff71b414f4c 45 API calls 16130 7ff71b427327 16129->16130 16134 7ff71b41ef24 5 API calls 16130->16134 16136 7ff71b427330 16130->16136 16133 7ff71b420ba3 16131->16133 16135 7ff71b41a948 __free_lconv_num 11 API calls 16131->16135 16132->16131 16133->15956 16133->15957 16134->16136 16135->16133 16137 7ff71b4154ac 14 API calls 16136->16137 16138 7ff71b42738b 16137->16138 16138->16128 16139 7ff71b427393 SetEnvironmentVariableW 16138->16139 16139->16128 16143 7ff71b4235d0 16140->16143 16148 7ff71b4202d8 EnterCriticalSection 16143->16148 16152 7ff71b41a778 16149->16152 16151 7ff71b41a8f9 16151->16039 16153 7ff71b41a7a3 16152->16153 16156 7ff71b41a814 16153->16156 16155 7ff71b41a7ca 16155->16151 16166 7ff71b41a55c 16156->16166 16159 7ff71b41a84f 16159->16155 16162 7ff71b41a900 _isindst 17 API calls 16163 7ff71b41a8df 16162->16163 16164 7ff71b41a778 _invalid_parameter_noinfo 37 API calls 16163->16164 16165 7ff71b41a8f9 16164->16165 16165->16155 16167 7ff71b41a578 GetLastError 16166->16167 16168 7ff71b41a5b3 16166->16168 16169 7ff71b41a588 16167->16169 16168->16159 16172 7ff71b41a5c8 16168->16172 16175 7ff71b41b390 16169->16175 16173 7ff71b41a5e4 GetLastError SetLastError 16172->16173 16174 7ff71b41a5fc 16172->16174 16173->16174 16174->16159 16174->16162 16176 7ff71b41b3ca FlsSetValue 16175->16176 16177 7ff71b41b3af FlsGetValue 16175->16177 16178 7ff71b41b3d7 16176->16178 16189 7ff71b41a5a3 SetLastError 16176->16189 16179 7ff71b41b3c4 16177->16179 16177->16189 16180 7ff71b41eb98 _get_daylight 11 API calls 16178->16180 16179->16176 16181 7ff71b41b3e6 16180->16181 16182 7ff71b41b404 FlsSetValue 16181->16182 16183 7ff71b41b3f4 FlsSetValue 16181->16183 16185 7ff71b41b410 FlsSetValue 16182->16185 16186 7ff71b41b422 16182->16186 16184 7ff71b41b3fd 16183->16184 16187 7ff71b41a948 __free_lconv_num 11 API calls 16184->16187 16185->16184 16192 7ff71b41aef4 16186->16192 16187->16189 16189->16168 16197 7ff71b41adcc 16192->16197 16209 7ff71b4202d8 EnterCriticalSection 16197->16209 16212 7ff71b41a64e __GetCurrentState __scrt_get_show_window_mode 16211->16212 16213 7ff71b41a676 RtlCaptureContext RtlLookupFunctionEntry 16212->16213 16214 7ff71b41a6b0 RtlVirtualUnwind 16213->16214 16215 7ff71b41a6e6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16213->16215 16214->16215 16217 7ff71b41a738 __GetCurrentState 16215->16217 16219 7ff71b40c550 16217->16219 16220 7ff71b40c559 16219->16220 16221 7ff71b40c8e0 IsProcessorFeaturePresent 16220->16221 16222 7ff71b40c564 GetCurrentProcess TerminateProcess 16220->16222 16223 7ff71b40c8f8 16221->16223 16228 7ff71b40cad8 RtlCaptureContext 16223->16228 16229 7ff71b40caf2 RtlLookupFunctionEntry 16228->16229 16230 7ff71b40cb08 RtlVirtualUnwind 16229->16230 16231 7ff71b40c90b 16229->16231 16230->16229 16230->16231 16232 7ff71b40c8a0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16231->16232 16234 7ff71b41b309 FlsSetValue 16233->16234 16240 7ff71b41b2ec 16233->16240 16235 7ff71b41b31b 16234->16235 16239 7ff71b41b2f9 16234->16239 16237 7ff71b41eb98 _get_daylight 5 API calls 16235->16237 16236 7ff71b41b375 SetLastError 16236->16048 16238 7ff71b41b32a 16237->16238 16241 7ff71b41b348 FlsSetValue 16238->16241 16242 7ff71b41b338 FlsSetValue 16238->16242 16239->16236 16240->16234 16240->16239 16244 7ff71b41b354 FlsSetValue 16241->16244 16245 7ff71b41b366 16241->16245 16243 7ff71b41b341 16242->16243 16246 7ff71b41a948 __free_lconv_num 5 API calls 16243->16246 16244->16243 16247 7ff71b41aef4 _get_daylight 5 API calls 16245->16247 16246->16239 16248 7ff71b41b36e 16247->16248 16249 7ff71b41a948 __free_lconv_num 5 API calls 16248->16249 16249->16236 16259 7ff71b423650 16250->16259 16285 7ff71b423608 16259->16285 16290 7ff71b4202d8 EnterCriticalSection 16285->16290 16317 7ff71b4191b1 16316->16317 16330 7ff71b4191ad 16316->16330 16339 7ff71b4225f0 16317->16339 16322 7ff71b4191cf 16365 7ff71b41927c 16322->16365 16323 7ff71b4191c3 16324 7ff71b41a948 __free_lconv_num 11 API calls 16323->16324 16324->16330 16327 7ff71b41a948 __free_lconv_num 11 API calls 16328 7ff71b4191f6 16327->16328 16329 7ff71b41a948 __free_lconv_num 11 API calls 16328->16329 16329->16330 16330->16067 16331 7ff71b4194ec 16330->16331 16332 7ff71b419515 16331->16332 16337 7ff71b41952e 16331->16337 16332->16067 16333 7ff71b4207e8 WideCharToMultiByte 16333->16337 16334 7ff71b41eb98 _get_daylight 11 API calls 16334->16337 16335 7ff71b4195be 16336 7ff71b41a948 __free_lconv_num 11 API calls 16335->16336 16336->16332 16337->16332 16337->16333 16337->16334 16337->16335 16338 7ff71b41a948 __free_lconv_num 11 API calls 16337->16338 16338->16337 16340 7ff71b4191b6 16339->16340 16341 7ff71b4225fd 16339->16341 16345 7ff71b42292c GetEnvironmentStringsW 16340->16345 16384 7ff71b41b224 16341->16384 16346 7ff71b4191bb 16345->16346 16347 7ff71b42295c 16345->16347 16346->16322 16346->16323 16348 7ff71b4207e8 WideCharToMultiByte 16347->16348 16349 7ff71b4229ad 16348->16349 16350 7ff71b4229b4 FreeEnvironmentStringsW 16349->16350 16351 7ff71b41d5fc _fread_nolock 12 API calls 16349->16351 16350->16346 16352 7ff71b4229c7 16351->16352 16353 7ff71b4229d8 16352->16353 16354 7ff71b4229cf 16352->16354 16356 7ff71b4207e8 WideCharToMultiByte 16353->16356 16355 7ff71b41a948 __free_lconv_num 11 API calls 16354->16355 16357 7ff71b4229d6 16355->16357 16358 7ff71b4229fb 16356->16358 16357->16350 16359 7ff71b422a09 16358->16359 16360 7ff71b4229ff 16358->16360 16362 7ff71b41a948 __free_lconv_num 11 API calls 16359->16362 16361 7ff71b41a948 __free_lconv_num 11 API calls 16360->16361 16363 7ff71b422a07 FreeEnvironmentStringsW 16361->16363 16362->16363 16363->16346 16367 7ff71b4192a1 16365->16367 16366 7ff71b41eb98 _get_daylight 11 API calls 16379 7ff71b4192d7 16366->16379 16367->16366 16367->16367 16368 7ff71b4192df 16369 7ff71b41a948 __free_lconv_num 11 API calls 16368->16369 16370 7ff71b4191d7 16369->16370 16370->16327 16371 7ff71b419352 16372 7ff71b41a948 __free_lconv_num 11 API calls 16371->16372 16372->16370 16373 7ff71b41eb98 _get_daylight 11 API calls 16373->16379 16374 7ff71b419341 16602 7ff71b4194a8 16374->16602 16375 7ff71b41a4a4 __std_exception_copy 37 API calls 16375->16379 16378 7ff71b419377 16381 7ff71b41a900 _isindst 17 API calls 16378->16381 16379->16368 16379->16371 16379->16373 16379->16374 16379->16375 16379->16378 16382 7ff71b41a948 __free_lconv_num 11 API calls 16379->16382 16380 7ff71b41a948 __free_lconv_num 11 API calls 16380->16368 16383 7ff71b41938a 16381->16383 16382->16379 16385 7ff71b41b250 FlsSetValue 16384->16385 16386 7ff71b41b235 FlsGetValue 16384->16386 16387 7ff71b41b25d 16385->16387 16389 7ff71b41b242 16385->16389 16388 7ff71b41b24a 16386->16388 16386->16389 16391 7ff71b41eb98 _get_daylight 11 API calls 16387->16391 16388->16385 16390 7ff71b41a504 __GetCurrentState 45 API calls 16389->16390 16392 7ff71b41b248 16389->16392 16393 7ff71b41b2c5 16390->16393 16394 7ff71b41b26c 16391->16394 16404 7ff71b4222c4 16392->16404 16395 7ff71b41b28a FlsSetValue 16394->16395 16396 7ff71b41b27a FlsSetValue 16394->16396 16398 7ff71b41b2a8 16395->16398 16399 7ff71b41b296 FlsSetValue 16395->16399 16397 7ff71b41b283 16396->16397 16400 7ff71b41a948 __free_lconv_num 11 API calls 16397->16400 16401 7ff71b41aef4 _get_daylight 11 API calls 16398->16401 16399->16397 16400->16389 16402 7ff71b41b2b0 16401->16402 16403 7ff71b41a948 __free_lconv_num 11 API calls 16402->16403 16403->16392 16427 7ff71b422534 16404->16427 16406 7ff71b4222f9 16442 7ff71b421fc4 16406->16442 16411 7ff71b42233e 16456 7ff71b42266c 16411->16456 16412 7ff71b42232f 16413 7ff71b41a948 __free_lconv_num 11 API calls 16412->16413 16426 7ff71b422316 16413->16426 16416 7ff71b42243a 16417 7ff71b414f08 _get_daylight 11 API calls 16416->16417 16418 7ff71b42243f 16417->16418 16422 7ff71b41a948 __free_lconv_num 11 API calls 16418->16422 16419 7ff71b422495 16421 7ff71b4224fc 16419->16421 16467 7ff71b421df4 16419->16467 16420 7ff71b422454 16420->16419 16423 7ff71b41a948 __free_lconv_num 11 API calls 16420->16423 16425 7ff71b41a948 __free_lconv_num 11 API calls 16421->16425 16422->16426 16423->16419 16425->16426 16426->16340 16428 7ff71b422557 16427->16428 16429 7ff71b422561 16428->16429 16482 7ff71b4202d8 EnterCriticalSection 16428->16482 16431 7ff71b4225d3 16429->16431 16434 7ff71b41a504 __GetCurrentState 45 API calls 16429->16434 16431->16406 16435 7ff71b4225eb 16434->16435 16437 7ff71b422642 16435->16437 16439 7ff71b41b224 50 API calls 16435->16439 16437->16406 16440 7ff71b42262c 16439->16440 16441 7ff71b4222c4 65 API calls 16440->16441 16441->16437 16483 7ff71b414f4c 16442->16483 16445 7ff71b421fe4 GetOEMCP 16448 7ff71b42200b 16445->16448 16446 7ff71b421ff6 16447 7ff71b421ffb GetACP 16446->16447 16446->16448 16447->16448 16448->16426 16449 7ff71b41d5fc 16448->16449 16450 7ff71b41d647 16449->16450 16451 7ff71b41d60b _get_daylight 16449->16451 16453 7ff71b414f08 _get_daylight 11 API calls 16450->16453 16451->16450 16452 7ff71b41d62e HeapAlloc 16451->16452 16455 7ff71b423590 _get_daylight 2 API calls 16451->16455 16452->16451 16454 7ff71b41d645 16452->16454 16453->16454 16454->16411 16454->16412 16455->16451 16457 7ff71b421fc4 47 API calls 16456->16457 16458 7ff71b422699 16457->16458 16459 7ff71b4227ef 16458->16459 16461 7ff71b4226d6 IsValidCodePage 16458->16461 16466 7ff71b4226f0 __scrt_get_show_window_mode 16458->16466 16460 7ff71b40c550 _log10_special 8 API calls 16459->16460 16462 7ff71b422431 16460->16462 16461->16459 16463 7ff71b4226e7 16461->16463 16462->16416 16462->16420 16464 7ff71b422716 GetCPInfo 16463->16464 16463->16466 16464->16459 16464->16466 16515 7ff71b4220dc 16466->16515 16601 7ff71b4202d8 EnterCriticalSection 16467->16601 16484 7ff71b414f6b 16483->16484 16485 7ff71b414f70 16483->16485 16484->16445 16484->16446 16485->16484 16486 7ff71b41b150 __GetCurrentState 45 API calls 16485->16486 16487 7ff71b414f8b 16486->16487 16491 7ff71b41d984 16487->16491 16492 7ff71b41d999 16491->16492 16493 7ff71b414fae 16491->16493 16492->16493 16499 7ff71b423304 16492->16499 16495 7ff71b41d9f0 16493->16495 16496 7ff71b41da18 16495->16496 16497 7ff71b41da05 16495->16497 16496->16484 16497->16496 16512 7ff71b422650 16497->16512 16500 7ff71b41b150 __GetCurrentState 45 API calls 16499->16500 16501 7ff71b423313 16500->16501 16503 7ff71b42335e 16501->16503 16511 7ff71b4202d8 EnterCriticalSection 16501->16511 16503->16493 16513 7ff71b41b150 __GetCurrentState 45 API calls 16512->16513 16514 7ff71b422659 16513->16514 16516 7ff71b422119 GetCPInfo 16515->16516 16517 7ff71b42220f 16515->16517 16516->16517 16523 7ff71b42212c 16516->16523 16518 7ff71b40c550 _log10_special 8 API calls 16517->16518 16520 7ff71b4222ae 16518->16520 16520->16459 16526 7ff71b422e40 16523->16526 16527 7ff71b414f4c 45 API calls 16526->16527 16528 7ff71b422e82 16527->16528 16546 7ff71b41f8a0 16528->16546 16547 7ff71b41f8a9 MultiByteToWideChar 16546->16547 16606 7ff71b4194ad 16602->16606 16607 7ff71b419349 16602->16607 16603 7ff71b4194d6 16605 7ff71b41a948 __free_lconv_num 11 API calls 16603->16605 16604 7ff71b41a948 __free_lconv_num 11 API calls 16604->16606 16605->16607 16606->16603 16606->16604 16607->16380 16609 7ff71b4262d8 16608->16609 16610 7ff71b4262c1 16608->16610 16609->16610 16613 7ff71b4262e6 16609->16613 16611 7ff71b414f08 _get_daylight 11 API calls 16610->16611 16612 7ff71b4262c6 16611->16612 16614 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16612->16614 16615 7ff71b414f4c 45 API calls 16613->16615 16616 7ff71b4262d1 16613->16616 16614->16616 16615->16616 16616->16085 16618 7ff71b414f4c 45 API calls 16617->16618 16619 7ff71b428f71 16618->16619 16622 7ff71b428bc8 16619->16622 16624 7ff71b428c16 16622->16624 16623 7ff71b40c550 _log10_special 8 API calls 16625 7ff71b427205 16623->16625 16626 7ff71b428c9d 16624->16626 16628 7ff71b428c88 GetCPInfo 16624->16628 16631 7ff71b428ca1 16624->16631 16625->16085 16625->16111 16627 7ff71b41f8a0 _fread_nolock MultiByteToWideChar 16626->16627 16626->16631 16629 7ff71b428d35 16627->16629 16628->16626 16628->16631 16630 7ff71b41d5fc _fread_nolock 12 API calls 16629->16630 16629->16631 16632 7ff71b428d6c 16629->16632 16630->16632 16631->16623 16632->16631 16633 7ff71b41f8a0 _fread_nolock MultiByteToWideChar 16632->16633 16634 7ff71b428dda 16633->16634 16635 7ff71b428ebc 16634->16635 16636 7ff71b41f8a0 _fread_nolock MultiByteToWideChar 16634->16636 16635->16631 16637 7ff71b41a948 __free_lconv_num 11 API calls 16635->16637 16638 7ff71b428e00 16636->16638 16637->16631 16638->16635 16639 7ff71b41d5fc _fread_nolock 12 API calls 16638->16639 16640 7ff71b428e2d 16638->16640 16639->16640 16640->16635 16641 7ff71b41f8a0 _fread_nolock MultiByteToWideChar 16640->16641 16642 7ff71b428ea4 16641->16642 16643 7ff71b428eaa 16642->16643 16644 7ff71b428ec4 16642->16644 16643->16635 16647 7ff71b41a948 __free_lconv_num 11 API calls 16643->16647 16651 7ff71b41ef68 16644->16651 16647->16635 16648 7ff71b41a948 __free_lconv_num 11 API calls 16649 7ff71b428f03 16648->16649 16649->16631 16650 7ff71b41a948 __free_lconv_num 11 API calls 16649->16650 16650->16631 16652 7ff71b41ed10 __crtLCMapStringW 5 API calls 16651->16652 16653 7ff71b41efa6 16652->16653 16654 7ff71b41efae 16653->16654 16655 7ff71b41f1d0 __crtLCMapStringW 5 API calls 16653->16655 16654->16648 16654->16649 16656 7ff71b41f017 CompareStringW 16655->16656 16656->16654 16658 7ff71b427c5a HeapSize 16657->16658 16659 7ff71b427c41 16657->16659 16660 7ff71b414f08 _get_daylight 11 API calls 16659->16660 16661 7ff71b427c46 16660->16661 16662 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 16661->16662 16663 7ff71b427c51 16662->16663 16663->16116 16665 7ff71b427c89 16664->16665 16666 7ff71b427c93 16664->16666 16667 7ff71b41d5fc _fread_nolock 12 API calls 16665->16667 16668 7ff71b427c98 16666->16668 16674 7ff71b427c9f _get_daylight 16666->16674 16672 7ff71b427c91 16667->16672 16671 7ff71b41a948 __free_lconv_num 11 API calls 16668->16671 16669 7ff71b427cd2 HeapReAlloc 16669->16672 16669->16674 16670 7ff71b427ca5 16673 7ff71b414f08 _get_daylight 11 API calls 16670->16673 16671->16672 16672->16120 16673->16672 16674->16669 16674->16670 16675 7ff71b423590 _get_daylight 2 API calls 16674->16675 16675->16674 16677 7ff71b41ed10 __crtLCMapStringW 5 API calls 16676->16677 16678 7ff71b41ef44 16677->16678 16678->16126 16680 7ff71b4154fa 16679->16680 16681 7ff71b4154d6 16679->16681 16682 7ff71b4154ff 16680->16682 16683 7ff71b415554 16680->16683 16685 7ff71b41a948 __free_lconv_num 11 API calls 16681->16685 16687 7ff71b4154e5 16681->16687 16682->16687 16688 7ff71b415514 16682->16688 16690 7ff71b41a948 __free_lconv_num 11 API calls 16682->16690 16684 7ff71b41f8a0 _fread_nolock MultiByteToWideChar 16683->16684 16686 7ff71b415570 16684->16686 16685->16687 16689 7ff71b415577 GetLastError 16686->16689 16695 7ff71b4155a5 16686->16695 16698 7ff71b41a948 __free_lconv_num 11 API calls 16686->16698 16700 7ff71b4155b2 16686->16700 16687->16128 16687->16129 16691 7ff71b41d5fc _fread_nolock 12 API calls 16688->16691 16701 7ff71b414e7c 16689->16701 16690->16688 16691->16687 16693 7ff71b41f8a0 _fread_nolock MultiByteToWideChar 16696 7ff71b4155f6 16693->16696 16699 7ff71b41d5fc _fread_nolock 12 API calls 16695->16699 16696->16687 16696->16689 16697 7ff71b414f08 _get_daylight 11 API calls 16697->16687 16698->16695 16699->16700 16700->16687 16700->16693 16702 7ff71b41b2c8 _get_daylight 11 API calls 16701->16702 16703 7ff71b414e89 __free_lconv_num 16702->16703 16704 7ff71b41b2c8 _get_daylight 11 API calls 16703->16704 16705 7ff71b414eab 16704->16705 16705->16697 20250 7ff71b419d50 20253 7ff71b419ccc 20250->20253 20260 7ff71b4202d8 EnterCriticalSection 20253->20260 20467 7ff71b41afd0 20468 7ff71b41afea 20467->20468 20469 7ff71b41afd5 20467->20469 20473 7ff71b41aff0 20469->20473 20474 7ff71b41b03a 20473->20474 20475 7ff71b41b032 20473->20475 20477 7ff71b41a948 __free_lconv_num 11 API calls 20474->20477 20476 7ff71b41a948 __free_lconv_num 11 API calls 20475->20476 20476->20474 20478 7ff71b41b047 20477->20478 20479 7ff71b41a948 __free_lconv_num 11 API calls 20478->20479 20480 7ff71b41b054 20479->20480 20481 7ff71b41a948 __free_lconv_num 11 API calls 20480->20481 20482 7ff71b41b061 20481->20482 20483 7ff71b41a948 __free_lconv_num 11 API calls 20482->20483 20484 7ff71b41b06e 20483->20484 20485 7ff71b41a948 __free_lconv_num 11 API calls 20484->20485 20486 7ff71b41b07b 20485->20486 20487 7ff71b41a948 __free_lconv_num 11 API calls 20486->20487 20488 7ff71b41b088 20487->20488 20489 7ff71b41a948 __free_lconv_num 11 API calls 20488->20489 20490 7ff71b41b095 20489->20490 20491 7ff71b41a948 __free_lconv_num 11 API calls 20490->20491 20492 7ff71b41b0a5 20491->20492 20493 7ff71b41a948 __free_lconv_num 11 API calls 20492->20493 20494 7ff71b41b0b5 20493->20494 20499 7ff71b41ae94 20494->20499 20513 7ff71b4202d8 EnterCriticalSection 20499->20513 20264 7ff71b40cb50 20265 7ff71b40cb60 20264->20265 20281 7ff71b419ba8 20265->20281 20267 7ff71b40cb6c 20287 7ff71b40ce48 20267->20287 20269 7ff71b40d12c 7 API calls 20271 7ff71b40cc05 20269->20271 20270 7ff71b40cb84 _RTC_Initialize 20279 7ff71b40cbd9 20270->20279 20292 7ff71b40cff8 20270->20292 20273 7ff71b40cb99 20295 7ff71b419014 20273->20295 20279->20269 20280 7ff71b40cbf5 20279->20280 20282 7ff71b419bb9 20281->20282 20283 7ff71b414f08 _get_daylight 11 API calls 20282->20283 20284 7ff71b419bc1 20282->20284 20285 7ff71b419bd0 20283->20285 20284->20267 20286 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 20285->20286 20286->20284 20288 7ff71b40ce59 20287->20288 20291 7ff71b40ce5e __scrt_release_startup_lock 20287->20291 20289 7ff71b40d12c 7 API calls 20288->20289 20288->20291 20290 7ff71b40ced2 20289->20290 20291->20270 20320 7ff71b40cfbc 20292->20320 20294 7ff71b40d001 20294->20273 20296 7ff71b419034 20295->20296 20297 7ff71b40cba5 20295->20297 20298 7ff71b41903c 20296->20298 20299 7ff71b419052 GetModuleFileNameW 20296->20299 20297->20279 20319 7ff71b40d0cc InitializeSListHead 20297->20319 20300 7ff71b414f08 _get_daylight 11 API calls 20298->20300 20303 7ff71b41907d 20299->20303 20301 7ff71b419041 20300->20301 20302 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 20301->20302 20302->20297 20304 7ff71b418fb4 11 API calls 20303->20304 20305 7ff71b4190bd 20304->20305 20306 7ff71b4190c5 20305->20306 20311 7ff71b4190dd 20305->20311 20307 7ff71b414f08 _get_daylight 11 API calls 20306->20307 20308 7ff71b4190ca 20307->20308 20309 7ff71b41a948 __free_lconv_num 11 API calls 20308->20309 20309->20297 20310 7ff71b4190ff 20312 7ff71b41a948 __free_lconv_num 11 API calls 20310->20312 20311->20310 20313 7ff71b41912b 20311->20313 20314 7ff71b419144 20311->20314 20312->20297 20315 7ff71b41a948 __free_lconv_num 11 API calls 20313->20315 20316 7ff71b41a948 __free_lconv_num 11 API calls 20314->20316 20317 7ff71b419134 20315->20317 20316->20310 20318 7ff71b41a948 __free_lconv_num 11 API calls 20317->20318 20318->20297 20321 7ff71b40cfcf 20320->20321 20322 7ff71b40cfd6 20320->20322 20321->20294 20324 7ff71b41a1ec 20322->20324 20327 7ff71b419e28 20324->20327 20334 7ff71b4202d8 EnterCriticalSection 20327->20334 16970 7ff71b40cc3c 16991 7ff71b40ce0c 16970->16991 16973 7ff71b40cd88 17145 7ff71b40d12c IsProcessorFeaturePresent 16973->17145 16974 7ff71b40cc58 __scrt_acquire_startup_lock 16976 7ff71b40cd92 16974->16976 16983 7ff71b40cc76 __scrt_release_startup_lock 16974->16983 16977 7ff71b40d12c 7 API calls 16976->16977 16979 7ff71b40cd9d __GetCurrentState 16977->16979 16978 7ff71b40cc9b 16980 7ff71b40cd21 16997 7ff71b40d274 16980->16997 16982 7ff71b40cd26 17000 7ff71b401000 16982->17000 16983->16978 16983->16980 17134 7ff71b419b2c 16983->17134 16988 7ff71b40cd49 16988->16979 17141 7ff71b40cf90 16988->17141 16992 7ff71b40ce14 16991->16992 16993 7ff71b40ce20 __scrt_dllmain_crt_thread_attach 16992->16993 16994 7ff71b40cc50 16993->16994 16995 7ff71b40ce2d 16993->16995 16994->16973 16994->16974 16995->16994 17152 7ff71b40d888 16995->17152 16998 7ff71b42a4d0 __scrt_get_show_window_mode 16997->16998 16999 7ff71b40d28b GetStartupInfoW 16998->16999 16999->16982 17001 7ff71b401009 17000->17001 17179 7ff71b415484 17001->17179 17003 7ff71b4037fb 17186 7ff71b4036b0 17003->17186 17008 7ff71b40c550 _log10_special 8 API calls 17011 7ff71b403ca7 17008->17011 17009 7ff71b40383c 17346 7ff71b401c80 17009->17346 17010 7ff71b40391b 17355 7ff71b4045c0 17010->17355 17139 7ff71b40d2b8 GetModuleHandleW 17011->17139 17014 7ff71b40385b 17258 7ff71b408830 17014->17258 17017 7ff71b40396a 17378 7ff71b402710 17017->17378 17020 7ff71b40388e 17027 7ff71b4038bb __std_exception_copy 17020->17027 17350 7ff71b4089a0 17020->17350 17021 7ff71b40395d 17022 7ff71b403984 17021->17022 17023 7ff71b403962 17021->17023 17025 7ff71b401c80 49 API calls 17022->17025 17374 7ff71b41004c 17023->17374 17028 7ff71b4039a3 17025->17028 17029 7ff71b408830 14 API calls 17027->17029 17036 7ff71b4038de __std_exception_copy 17027->17036 17033 7ff71b401950 115 API calls 17028->17033 17029->17036 17031 7ff71b403a0b 17032 7ff71b4089a0 40 API calls 17031->17032 17034 7ff71b403a17 17032->17034 17035 7ff71b4039ce 17033->17035 17037 7ff71b4089a0 40 API calls 17034->17037 17035->17014 17038 7ff71b4039de 17035->17038 17042 7ff71b40390e __std_exception_copy 17036->17042 17389 7ff71b408940 17036->17389 17039 7ff71b403a23 17037->17039 17040 7ff71b402710 54 API calls 17038->17040 17041 7ff71b4089a0 40 API calls 17039->17041 17123 7ff71b403808 __std_exception_copy 17040->17123 17041->17042 17043 7ff71b408830 14 API calls 17042->17043 17044 7ff71b403a3b 17043->17044 17045 7ff71b403b2f 17044->17045 17046 7ff71b403a60 __std_exception_copy 17044->17046 17047 7ff71b402710 54 API calls 17045->17047 17048 7ff71b408940 40 API calls 17046->17048 17059 7ff71b403aab 17046->17059 17047->17123 17048->17059 17049 7ff71b408830 14 API calls 17050 7ff71b403bf4 __std_exception_copy 17049->17050 17051 7ff71b403c46 17050->17051 17052 7ff71b403d41 17050->17052 17053 7ff71b403cd4 17051->17053 17054 7ff71b403c50 17051->17054 17396 7ff71b4044e0 17052->17396 17057 7ff71b408830 14 API calls 17053->17057 17271 7ff71b4090e0 17054->17271 17061 7ff71b403ce0 17057->17061 17058 7ff71b403d4f 17062 7ff71b403d65 17058->17062 17063 7ff71b403d71 17058->17063 17059->17049 17064 7ff71b403c61 17061->17064 17068 7ff71b403ced 17061->17068 17399 7ff71b404630 17062->17399 17066 7ff71b401c80 49 API calls 17063->17066 17070 7ff71b402710 54 API calls 17064->17070 17077 7ff71b403cc8 __std_exception_copy 17066->17077 17071 7ff71b401c80 49 API calls 17068->17071 17070->17123 17074 7ff71b403d0b 17071->17074 17072 7ff71b403dc4 17321 7ff71b409390 17072->17321 17076 7ff71b403d12 17074->17076 17074->17077 17075 7ff71b403dd7 SetDllDirectoryW 17081 7ff71b403e0a 17075->17081 17124 7ff71b403e5a 17075->17124 17080 7ff71b402710 54 API calls 17076->17080 17077->17072 17078 7ff71b403da7 SetDllDirectoryW LoadLibraryExW 17077->17078 17078->17072 17080->17123 17083 7ff71b408830 14 API calls 17081->17083 17082 7ff71b404008 17085 7ff71b404035 17082->17085 17086 7ff71b404012 PostMessageW GetMessageW 17082->17086 17090 7ff71b403e16 __std_exception_copy 17083->17090 17084 7ff71b403f1b 17326 7ff71b4033c0 17084->17326 17476 7ff71b403360 17085->17476 17086->17085 17093 7ff71b403ef2 17090->17093 17094 7ff71b403e4e 17090->17094 17097 7ff71b408940 40 API calls 17093->17097 17094->17124 17402 7ff71b406dc0 17094->17402 17097->17124 17102 7ff71b406fc0 FreeLibrary 17105 7ff71b40405b 17102->17105 17110 7ff71b403e81 17113 7ff71b403ea2 17110->17113 17125 7ff71b403e85 17110->17125 17423 7ff71b406e00 17110->17423 17113->17125 17442 7ff71b4071b0 17113->17442 17123->17008 17124->17082 17124->17084 17125->17124 17458 7ff71b402a50 17125->17458 17135 7ff71b419b64 17134->17135 17136 7ff71b419b43 17134->17136 19404 7ff71b41a3d8 17135->19404 17136->16980 17140 7ff71b40d2c9 17139->17140 17140->16988 17143 7ff71b40cfa1 17141->17143 17142 7ff71b40cd60 17142->16978 17143->17142 17144 7ff71b40d888 7 API calls 17143->17144 17144->17142 17146 7ff71b40d152 __GetCurrentState __scrt_get_show_window_mode 17145->17146 17147 7ff71b40d171 RtlCaptureContext RtlLookupFunctionEntry 17146->17147 17148 7ff71b40d19a RtlVirtualUnwind 17147->17148 17149 7ff71b40d1d6 __scrt_get_show_window_mode 17147->17149 17148->17149 17150 7ff71b40d208 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17149->17150 17151 7ff71b40d256 __GetCurrentState 17150->17151 17151->16976 17153 7ff71b40d89a 17152->17153 17154 7ff71b40d890 17152->17154 17153->16994 17158 7ff71b40dc24 17154->17158 17159 7ff71b40d895 17158->17159 17160 7ff71b40dc33 17158->17160 17162 7ff71b40dc90 17159->17162 17166 7ff71b40de60 17160->17166 17163 7ff71b40dcbb 17162->17163 17164 7ff71b40dc9e DeleteCriticalSection 17163->17164 17165 7ff71b40dcbf 17163->17165 17164->17163 17165->17153 17170 7ff71b40dcc8 17166->17170 17171 7ff71b40ddb2 TlsFree 17170->17171 17173 7ff71b40dd0c __vcrt_InitializeCriticalSectionEx 17170->17173 17172 7ff71b40dd3a LoadLibraryExW 17175 7ff71b40ddd9 17172->17175 17176 7ff71b40dd5b GetLastError 17172->17176 17173->17171 17173->17172 17174 7ff71b40ddf9 GetProcAddress 17173->17174 17178 7ff71b40dd7d LoadLibraryExW 17173->17178 17174->17171 17175->17174 17177 7ff71b40ddf0 FreeLibrary 17175->17177 17176->17173 17177->17174 17178->17173 17178->17175 17180 7ff71b41f480 17179->17180 17182 7ff71b41f526 17180->17182 17184 7ff71b41f4d3 17180->17184 17181 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17185 7ff71b41f4fc 17181->17185 17489 7ff71b41f358 17182->17489 17184->17181 17185->17003 17497 7ff71b40c850 17186->17497 17189 7ff71b403710 17499 7ff71b409280 FindFirstFileExW 17189->17499 17190 7ff71b4036eb GetLastError 17504 7ff71b402c50 17190->17504 17193 7ff71b403706 17198 7ff71b40c550 _log10_special 8 API calls 17193->17198 17195 7ff71b403723 17519 7ff71b409300 CreateFileW 17195->17519 17196 7ff71b40377d 17530 7ff71b409440 17196->17530 17200 7ff71b4037b5 17198->17200 17200->17123 17208 7ff71b401950 17200->17208 17202 7ff71b40378b 17202->17193 17206 7ff71b402810 49 API calls 17202->17206 17203 7ff71b403734 17522 7ff71b402810 17203->17522 17204 7ff71b40374c __vcrt_InitializeCriticalSectionEx 17204->17196 17206->17193 17209 7ff71b4045c0 108 API calls 17208->17209 17210 7ff71b401985 17209->17210 17211 7ff71b401c43 17210->17211 17212 7ff71b407f90 83 API calls 17210->17212 17213 7ff71b40c550 _log10_special 8 API calls 17211->17213 17215 7ff71b4019cb 17212->17215 17214 7ff71b401c5e 17213->17214 17214->17009 17214->17010 17228 7ff71b401a03 17215->17228 17875 7ff71b4106d4 17215->17875 17217 7ff71b41004c 74 API calls 17217->17211 17218 7ff71b4019e5 17219 7ff71b4019e9 17218->17219 17220 7ff71b401a08 17218->17220 17222 7ff71b414f08 _get_daylight 11 API calls 17219->17222 17879 7ff71b41039c 17220->17879 17224 7ff71b4019ee 17222->17224 17882 7ff71b402910 17224->17882 17225 7ff71b401a26 17229 7ff71b414f08 _get_daylight 11 API calls 17225->17229 17226 7ff71b401a45 17232 7ff71b401a5c 17226->17232 17233 7ff71b401a7b 17226->17233 17228->17217 17230 7ff71b401a2b 17229->17230 17231 7ff71b402910 54 API calls 17230->17231 17231->17228 17235 7ff71b414f08 _get_daylight 11 API calls 17232->17235 17234 7ff71b401c80 49 API calls 17233->17234 17236 7ff71b401a92 17234->17236 17237 7ff71b401a61 17235->17237 17238 7ff71b401c80 49 API calls 17236->17238 17239 7ff71b402910 54 API calls 17237->17239 17240 7ff71b401add 17238->17240 17239->17228 17241 7ff71b4106d4 73 API calls 17240->17241 17242 7ff71b401b01 17241->17242 17243 7ff71b401b16 17242->17243 17244 7ff71b401b35 17242->17244 17246 7ff71b414f08 _get_daylight 11 API calls 17243->17246 17245 7ff71b41039c _fread_nolock 53 API calls 17244->17245 17247 7ff71b401b4a 17245->17247 17248 7ff71b401b1b 17246->17248 17249 7ff71b401b50 17247->17249 17250 7ff71b401b6f 17247->17250 17251 7ff71b402910 54 API calls 17248->17251 17252 7ff71b414f08 _get_daylight 11 API calls 17249->17252 17897 7ff71b410110 17250->17897 17251->17228 17254 7ff71b401b55 17252->17254 17256 7ff71b402910 54 API calls 17254->17256 17256->17228 17257 7ff71b402710 54 API calls 17257->17228 17259 7ff71b40883a 17258->17259 17260 7ff71b409390 2 API calls 17259->17260 17261 7ff71b408859 GetEnvironmentVariableW 17260->17261 17262 7ff71b4088c2 17261->17262 17263 7ff71b408876 ExpandEnvironmentStringsW 17261->17263 17265 7ff71b40c550 _log10_special 8 API calls 17262->17265 17263->17262 17264 7ff71b408898 17263->17264 17266 7ff71b409440 2 API calls 17264->17266 17267 7ff71b4088d4 17265->17267 17268 7ff71b4088aa 17266->17268 17267->17020 17269 7ff71b40c550 _log10_special 8 API calls 17268->17269 17270 7ff71b4088ba 17269->17270 17270->17020 17272 7ff71b4090f5 17271->17272 18112 7ff71b408570 GetCurrentProcess OpenProcessToken 17272->18112 17275 7ff71b408570 7 API calls 17276 7ff71b409121 17275->17276 17277 7ff71b40913a 17276->17277 17278 7ff71b409154 17276->17278 17280 7ff71b4026b0 48 API calls 17277->17280 17279 7ff71b4026b0 48 API calls 17278->17279 17282 7ff71b409167 LocalFree LocalFree 17279->17282 17281 7ff71b409152 17280->17281 17281->17282 17283 7ff71b409183 17282->17283 17285 7ff71b40918f 17282->17285 18122 7ff71b402b50 17283->18122 17286 7ff71b40c550 _log10_special 8 API calls 17285->17286 17287 7ff71b403c55 17286->17287 17287->17064 17288 7ff71b408660 17287->17288 17289 7ff71b408678 17288->17289 17290 7ff71b4086fa GetTempPathW GetCurrentProcessId 17289->17290 17291 7ff71b40869c 17289->17291 18131 7ff71b4025c0 17290->18131 17293 7ff71b408830 14 API calls 17291->17293 17294 7ff71b4086a8 17293->17294 18138 7ff71b4081d0 17294->18138 17299 7ff71b4086e8 __std_exception_copy 17320 7ff71b4087d4 __std_exception_copy 17299->17320 17301 7ff71b408728 __std_exception_copy 17307 7ff71b408765 __std_exception_copy 17301->17307 18135 7ff71b418b68 17301->18135 17306 7ff71b40c550 _log10_special 8 API calls 17310 7ff71b403cbb 17306->17310 17312 7ff71b409390 2 API calls 17307->17312 17307->17320 17310->17064 17310->17077 17313 7ff71b4087b1 17312->17313 17314 7ff71b4087e9 17313->17314 17315 7ff71b4087b6 17313->17315 17316 7ff71b418238 38 API calls 17314->17316 17317 7ff71b409390 2 API calls 17315->17317 17316->17320 17318 7ff71b4087c6 17317->17318 17319 7ff71b418238 38 API calls 17318->17319 17319->17320 17320->17306 17322 7ff71b4093b2 MultiByteToWideChar 17321->17322 17323 7ff71b4093d6 17321->17323 17322->17323 17325 7ff71b4093ec __std_exception_copy 17322->17325 17324 7ff71b4093f3 MultiByteToWideChar 17323->17324 17323->17325 17324->17325 17325->17075 17337 7ff71b4033ce __scrt_get_show_window_mode 17326->17337 17327 7ff71b40c550 _log10_special 8 API calls 17329 7ff71b403664 17327->17329 17328 7ff71b4035c7 17328->17327 17329->17123 17345 7ff71b4090c0 LocalFree 17329->17345 17331 7ff71b401c80 49 API calls 17331->17337 17332 7ff71b4035e2 17334 7ff71b402710 54 API calls 17332->17334 17334->17328 17337->17328 17337->17331 17337->17332 17338 7ff71b4035c9 17337->17338 17339 7ff71b402a50 54 API calls 17337->17339 17343 7ff71b4035d0 17337->17343 18327 7ff71b404560 17337->18327 18333 7ff71b407e20 17337->18333 18344 7ff71b401600 17337->18344 18392 7ff71b407120 17337->18392 18396 7ff71b404190 17337->18396 18440 7ff71b404450 17337->18440 17340 7ff71b402710 54 API calls 17338->17340 17339->17337 17340->17328 17344 7ff71b402710 54 API calls 17343->17344 17344->17328 17347 7ff71b401ca5 17346->17347 17348 7ff71b414984 49 API calls 17347->17348 17349 7ff71b401cc8 17348->17349 17349->17014 17351 7ff71b409390 2 API calls 17350->17351 17352 7ff71b4089b4 17351->17352 17353 7ff71b418238 38 API calls 17352->17353 17354 7ff71b4089c6 __std_exception_copy 17353->17354 17354->17027 17356 7ff71b4045cc 17355->17356 17357 7ff71b409390 2 API calls 17356->17357 17358 7ff71b4045f4 17357->17358 17359 7ff71b409390 2 API calls 17358->17359 17360 7ff71b404607 17359->17360 18607 7ff71b415f94 17360->18607 17363 7ff71b40c550 _log10_special 8 API calls 17364 7ff71b40392b 17363->17364 17364->17017 17365 7ff71b407f90 17364->17365 17366 7ff71b407fb4 17365->17366 17367 7ff71b4106d4 73 API calls 17366->17367 17372 7ff71b40808b __std_exception_copy 17366->17372 17368 7ff71b407fd0 17367->17368 17368->17372 18998 7ff71b4178c8 17368->18998 17370 7ff71b4106d4 73 API calls 17373 7ff71b407fe5 17370->17373 17371 7ff71b41039c _fread_nolock 53 API calls 17371->17373 17372->17021 17373->17370 17373->17371 17373->17372 17375 7ff71b41007c 17374->17375 19013 7ff71b40fe28 17375->19013 17377 7ff71b410095 17377->17017 17379 7ff71b40c850 17378->17379 17380 7ff71b402734 GetCurrentProcessId 17379->17380 17381 7ff71b401c80 49 API calls 17380->17381 17382 7ff71b402787 17381->17382 17383 7ff71b414984 49 API calls 17382->17383 17384 7ff71b4027cf 17383->17384 17385 7ff71b402620 12 API calls 17384->17385 17386 7ff71b4027f1 17385->17386 17387 7ff71b40c550 _log10_special 8 API calls 17386->17387 17388 7ff71b402801 17387->17388 17388->17123 17390 7ff71b409390 2 API calls 17389->17390 17391 7ff71b40895c 17390->17391 17392 7ff71b409390 2 API calls 17391->17392 17393 7ff71b40896c 17392->17393 17394 7ff71b418238 38 API calls 17393->17394 17395 7ff71b40897a __std_exception_copy 17394->17395 17395->17031 17397 7ff71b401c80 49 API calls 17396->17397 17398 7ff71b4044fd 17397->17398 17398->17058 17400 7ff71b401c80 49 API calls 17399->17400 17401 7ff71b404660 17400->17401 17401->17077 17401->17401 17403 7ff71b406dd5 17402->17403 17404 7ff71b403e6c 17403->17404 17405 7ff71b414f08 _get_daylight 11 API calls 17403->17405 17408 7ff71b407340 17404->17408 17406 7ff71b406de2 17405->17406 17407 7ff71b402910 54 API calls 17406->17407 17407->17404 19024 7ff71b401470 17408->19024 17410 7ff71b407368 17411 7ff71b4074b9 __std_exception_copy 17410->17411 17412 7ff71b404630 49 API calls 17410->17412 17411->17110 17413 7ff71b40738a 17412->17413 17414 7ff71b40738f 17413->17414 17415 7ff71b404630 49 API calls 17413->17415 17416 7ff71b402a50 54 API calls 17414->17416 17417 7ff71b4073ae 17415->17417 17416->17411 17417->17414 17424 7ff71b406e1c 17423->17424 19130 7ff71b406360 17476->19130 17484 7ff71b403399 17485 7ff71b403670 17484->17485 17486 7ff71b40367e 17485->17486 17487 7ff71b40368f 17486->17487 19403 7ff71b408e60 FreeLibrary 17486->19403 17487->17102 17496 7ff71b41546c EnterCriticalSection 17489->17496 17498 7ff71b4036bc GetModuleFileNameW 17497->17498 17498->17189 17498->17190 17500 7ff71b4092bf FindClose 17499->17500 17501 7ff71b4092d2 17499->17501 17500->17501 17502 7ff71b40c550 _log10_special 8 API calls 17501->17502 17503 7ff71b40371a 17502->17503 17503->17195 17503->17196 17505 7ff71b40c850 17504->17505 17506 7ff71b402c70 GetCurrentProcessId 17505->17506 17535 7ff71b4026b0 17506->17535 17508 7ff71b402cb9 17539 7ff71b414bd8 17508->17539 17511 7ff71b4026b0 48 API calls 17512 7ff71b402d34 FormatMessageW 17511->17512 17514 7ff71b402d7f MessageBoxW 17512->17514 17515 7ff71b402d6d 17512->17515 17517 7ff71b40c550 _log10_special 8 API calls 17514->17517 17516 7ff71b4026b0 48 API calls 17515->17516 17516->17514 17518 7ff71b402daf 17517->17518 17518->17193 17520 7ff71b403730 17519->17520 17521 7ff71b409340 GetFinalPathNameByHandleW CloseHandle 17519->17521 17520->17203 17520->17204 17521->17520 17523 7ff71b402834 17522->17523 17524 7ff71b4026b0 48 API calls 17523->17524 17525 7ff71b402887 17524->17525 17526 7ff71b414bd8 48 API calls 17525->17526 17527 7ff71b4028d0 MessageBoxW 17526->17527 17528 7ff71b40c550 _log10_special 8 API calls 17527->17528 17529 7ff71b402900 17528->17529 17529->17193 17531 7ff71b40946a WideCharToMultiByte 17530->17531 17532 7ff71b409495 17530->17532 17531->17532 17534 7ff71b4094ab __std_exception_copy 17531->17534 17533 7ff71b4094b2 WideCharToMultiByte 17532->17533 17532->17534 17533->17534 17534->17202 17536 7ff71b4026d5 17535->17536 17537 7ff71b414bd8 48 API calls 17536->17537 17538 7ff71b4026f8 17537->17538 17538->17508 17542 7ff71b414c32 17539->17542 17540 7ff71b414c57 17541 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17540->17541 17545 7ff71b414c81 17541->17545 17542->17540 17543 7ff71b414c93 17542->17543 17557 7ff71b412f90 17543->17557 17547 7ff71b40c550 _log10_special 8 API calls 17545->17547 17546 7ff71b414d40 17554 7ff71b414d74 17546->17554 17556 7ff71b414d49 17546->17556 17549 7ff71b402d04 17547->17549 17548 7ff71b41a948 __free_lconv_num 11 API calls 17548->17545 17549->17511 17551 7ff71b414d9a 17552 7ff71b414da4 17551->17552 17551->17554 17555 7ff71b41a948 __free_lconv_num 11 API calls 17552->17555 17553 7ff71b41a948 __free_lconv_num 11 API calls 17553->17545 17554->17548 17555->17545 17556->17553 17558 7ff71b412fce 17557->17558 17559 7ff71b412fbe 17557->17559 17560 7ff71b412fd7 17558->17560 17565 7ff71b413005 17558->17565 17562 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17559->17562 17563 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17560->17563 17561 7ff71b412ffd 17561->17546 17561->17551 17561->17554 17561->17556 17562->17561 17563->17561 17565->17559 17565->17561 17568 7ff71b4139a4 17565->17568 17601 7ff71b4133f0 17565->17601 17638 7ff71b412b80 17565->17638 17569 7ff71b413a57 17568->17569 17570 7ff71b4139e6 17568->17570 17573 7ff71b413a5c 17569->17573 17574 7ff71b413ab0 17569->17574 17571 7ff71b4139ec 17570->17571 17572 7ff71b413a81 17570->17572 17575 7ff71b413a20 17571->17575 17576 7ff71b4139f1 17571->17576 17661 7ff71b411d54 17572->17661 17577 7ff71b413a5e 17573->17577 17578 7ff71b413a91 17573->17578 17580 7ff71b413ac7 17574->17580 17582 7ff71b413aba 17574->17582 17586 7ff71b413abf 17574->17586 17583 7ff71b4139f7 17575->17583 17575->17586 17576->17580 17576->17583 17581 7ff71b413a00 17577->17581 17590 7ff71b413a6d 17577->17590 17668 7ff71b411944 17578->17668 17675 7ff71b4146ac 17580->17675 17599 7ff71b413af0 17581->17599 17641 7ff71b414158 17581->17641 17582->17572 17582->17586 17583->17581 17589 7ff71b413a32 17583->17589 17596 7ff71b413a1b 17583->17596 17586->17599 17679 7ff71b412164 17586->17679 17589->17599 17651 7ff71b414494 17589->17651 17590->17572 17591 7ff71b413a72 17590->17591 17591->17599 17657 7ff71b414558 17591->17657 17593 7ff71b40c550 _log10_special 8 API calls 17594 7ff71b413dea 17593->17594 17594->17565 17596->17599 17600 7ff71b413cdc 17596->17600 17686 7ff71b4147c0 17596->17686 17599->17593 17600->17599 17692 7ff71b41ea08 17600->17692 17602 7ff71b4133fe 17601->17602 17603 7ff71b413414 17601->17603 17604 7ff71b413454 17602->17604 17606 7ff71b413a57 17602->17606 17607 7ff71b4139e6 17602->17607 17603->17604 17605 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17603->17605 17604->17565 17605->17604 17610 7ff71b413a5c 17606->17610 17611 7ff71b413ab0 17606->17611 17608 7ff71b4139ec 17607->17608 17609 7ff71b413a81 17607->17609 17612 7ff71b413a20 17608->17612 17613 7ff71b4139f1 17608->17613 17615 7ff71b411d54 38 API calls 17609->17615 17614 7ff71b413a91 17610->17614 17623 7ff71b413a5e 17610->17623 17616 7ff71b413ac7 17611->17616 17617 7ff71b413aba 17611->17617 17622 7ff71b413abf 17611->17622 17618 7ff71b4139f7 17612->17618 17612->17622 17613->17616 17613->17618 17619 7ff71b411944 38 API calls 17614->17619 17634 7ff71b413a1b 17615->17634 17621 7ff71b4146ac 45 API calls 17616->17621 17617->17609 17617->17622 17624 7ff71b413a32 17618->17624 17625 7ff71b413a00 17618->17625 17618->17634 17619->17634 17620 7ff71b414158 47 API calls 17620->17634 17621->17634 17626 7ff71b412164 38 API calls 17622->17626 17637 7ff71b413af0 17622->17637 17623->17625 17627 7ff71b413a6d 17623->17627 17628 7ff71b414494 46 API calls 17624->17628 17624->17637 17625->17620 17625->17637 17626->17634 17627->17609 17629 7ff71b413a72 17627->17629 17628->17634 17632 7ff71b414558 37 API calls 17629->17632 17629->17637 17630 7ff71b40c550 _log10_special 8 API calls 17631 7ff71b413dea 17630->17631 17631->17565 17632->17634 17633 7ff71b4147c0 45 API calls 17636 7ff71b413cdc 17633->17636 17634->17633 17634->17636 17634->17637 17635 7ff71b41ea08 46 API calls 17635->17636 17636->17635 17636->17637 17637->17630 17858 7ff71b410fc8 17638->17858 17642 7ff71b41417e 17641->17642 17704 7ff71b410b80 17642->17704 17647 7ff71b4147c0 45 API calls 17648 7ff71b4142c3 17647->17648 17649 7ff71b4147c0 45 API calls 17648->17649 17650 7ff71b414351 17648->17650 17649->17650 17650->17596 17654 7ff71b4144c9 17651->17654 17652 7ff71b41450e 17652->17596 17653 7ff71b4144e7 17656 7ff71b41ea08 46 API calls 17653->17656 17654->17652 17654->17653 17655 7ff71b4147c0 45 API calls 17654->17655 17655->17653 17656->17652 17660 7ff71b414579 17657->17660 17658 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17659 7ff71b4145aa 17658->17659 17659->17596 17660->17658 17660->17659 17662 7ff71b411d87 17661->17662 17663 7ff71b411db6 17662->17663 17665 7ff71b411e73 17662->17665 17667 7ff71b411df3 17663->17667 17831 7ff71b410c28 17663->17831 17666 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17665->17666 17666->17667 17667->17596 17669 7ff71b411977 17668->17669 17670 7ff71b4119a6 17669->17670 17672 7ff71b411a63 17669->17672 17671 7ff71b410c28 12 API calls 17670->17671 17673 7ff71b4119e3 17670->17673 17671->17673 17674 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17672->17674 17673->17596 17674->17673 17676 7ff71b4146ef 17675->17676 17678 7ff71b4146f3 __crtLCMapStringW 17676->17678 17839 7ff71b414748 17676->17839 17678->17596 17680 7ff71b412197 17679->17680 17681 7ff71b4121c6 17680->17681 17683 7ff71b412283 17680->17683 17682 7ff71b410c28 12 API calls 17681->17682 17685 7ff71b412203 17681->17685 17682->17685 17684 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17683->17684 17684->17685 17685->17596 17687 7ff71b4147d7 17686->17687 17843 7ff71b41d9b8 17687->17843 17693 7ff71b41ea47 17692->17693 17695 7ff71b41ea39 17692->17695 17693->17600 17694 7ff71b41ea67 17697 7ff71b41ea78 17694->17697 17698 7ff71b41ea9f 17694->17698 17695->17693 17695->17694 17696 7ff71b4147c0 45 API calls 17695->17696 17696->17694 17851 7ff71b4200a0 17697->17851 17698->17693 17700 7ff71b41eb2a 17698->17700 17701 7ff71b41eac9 17698->17701 17702 7ff71b41f8a0 _fread_nolock MultiByteToWideChar 17700->17702 17701->17693 17703 7ff71b41f8a0 _fread_nolock MultiByteToWideChar 17701->17703 17702->17693 17703->17693 17705 7ff71b410bb7 17704->17705 17711 7ff71b410ba6 17704->17711 17706 7ff71b41d5fc _fread_nolock 12 API calls 17705->17706 17705->17711 17707 7ff71b410be4 17706->17707 17708 7ff71b410bf8 17707->17708 17709 7ff71b41a948 __free_lconv_num 11 API calls 17707->17709 17710 7ff71b41a948 __free_lconv_num 11 API calls 17708->17710 17709->17708 17710->17711 17712 7ff71b41e570 17711->17712 17713 7ff71b41e58d 17712->17713 17714 7ff71b41e5c0 17712->17714 17715 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17713->17715 17714->17713 17716 7ff71b41e5f2 17714->17716 17724 7ff71b4142a1 17715->17724 17720 7ff71b41e705 17716->17720 17729 7ff71b41e63a 17716->17729 17717 7ff71b41e7f7 17758 7ff71b41da5c 17717->17758 17719 7ff71b41e7bd 17751 7ff71b41ddf4 17719->17751 17720->17717 17720->17719 17721 7ff71b41e78c 17720->17721 17723 7ff71b41e74f 17720->17723 17726 7ff71b41e745 17720->17726 17744 7ff71b41e0d4 17721->17744 17734 7ff71b41e304 17723->17734 17724->17647 17724->17648 17726->17719 17728 7ff71b41e74a 17726->17728 17728->17721 17728->17723 17729->17724 17730 7ff71b41a4a4 __std_exception_copy 37 API calls 17729->17730 17731 7ff71b41e6f2 17730->17731 17731->17724 17732 7ff71b41a900 _isindst 17 API calls 17731->17732 17733 7ff71b41e854 17732->17733 17767 7ff71b4240ac 17734->17767 17738 7ff71b41e3b0 17738->17724 17739 7ff71b41e401 17820 7ff71b41def0 17739->17820 17740 7ff71b41e3ac 17740->17738 17740->17739 17741 7ff71b41e3cc 17740->17741 17816 7ff71b41e1ac 17741->17816 17745 7ff71b4240ac 38 API calls 17744->17745 17746 7ff71b41e11e 17745->17746 17747 7ff71b423af4 37 API calls 17746->17747 17748 7ff71b41e16e 17747->17748 17749 7ff71b41e172 17748->17749 17750 7ff71b41e1ac 45 API calls 17748->17750 17749->17724 17750->17749 17752 7ff71b4240ac 38 API calls 17751->17752 17753 7ff71b41de3f 17752->17753 17754 7ff71b423af4 37 API calls 17753->17754 17756 7ff71b41de97 17754->17756 17755 7ff71b41de9b 17755->17724 17756->17755 17757 7ff71b41def0 45 API calls 17756->17757 17757->17755 17759 7ff71b41daa1 17758->17759 17760 7ff71b41dad4 17758->17760 17761 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17759->17761 17762 7ff71b41daec 17760->17762 17765 7ff71b41db6d 17760->17765 17764 7ff71b41dacd __scrt_get_show_window_mode 17761->17764 17763 7ff71b41ddf4 46 API calls 17762->17763 17763->17764 17764->17724 17765->17764 17766 7ff71b4147c0 45 API calls 17765->17766 17766->17764 17768 7ff71b4240ff fegetenv 17767->17768 17769 7ff71b427e2c 37 API calls 17768->17769 17774 7ff71b424152 17769->17774 17770 7ff71b42417f 17773 7ff71b41a4a4 __std_exception_copy 37 API calls 17770->17773 17771 7ff71b424242 17772 7ff71b427e2c 37 API calls 17771->17772 17775 7ff71b42426c 17772->17775 17777 7ff71b4241fd 17773->17777 17774->17771 17778 7ff71b42416d 17774->17778 17779 7ff71b42421c 17774->17779 17776 7ff71b427e2c 37 API calls 17775->17776 17780 7ff71b42427d 17776->17780 17781 7ff71b425324 17777->17781 17786 7ff71b424205 17777->17786 17778->17770 17778->17771 17782 7ff71b41a4a4 __std_exception_copy 37 API calls 17779->17782 17783 7ff71b428020 20 API calls 17780->17783 17784 7ff71b41a900 _isindst 17 API calls 17781->17784 17782->17777 17795 7ff71b4242e6 __scrt_get_show_window_mode 17783->17795 17785 7ff71b425339 17784->17785 17787 7ff71b40c550 _log10_special 8 API calls 17786->17787 17788 7ff71b41e351 17787->17788 17812 7ff71b423af4 17788->17812 17789 7ff71b42468f __scrt_get_show_window_mode 17790 7ff71b4249cf 17791 7ff71b423c10 37 API calls 17790->17791 17797 7ff71b4250e7 17791->17797 17792 7ff71b42497b 17792->17790 17792->17792 17796 7ff71b42533c memcpy_s 37 API calls 17792->17796 17793 7ff71b425142 17801 7ff71b4252c8 17793->17801 17807 7ff71b423c10 37 API calls 17793->17807 17810 7ff71b42533c memcpy_s 37 API calls 17793->17810 17794 7ff71b424327 memcpy_s 17806 7ff71b424783 memcpy_s __scrt_get_show_window_mode 17794->17806 17811 7ff71b424c6b memcpy_s __scrt_get_show_window_mode 17794->17811 17795->17789 17795->17794 17798 7ff71b414f08 _get_daylight 11 API calls 17795->17798 17796->17790 17797->17793 17797->17797 17802 7ff71b42533c memcpy_s 37 API calls 17797->17802 17799 7ff71b424760 17798->17799 17800 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 17799->17800 17800->17794 17803 7ff71b427e2c 37 API calls 17801->17803 17802->17793 17803->17786 17804 7ff71b414f08 11 API calls _get_daylight 17804->17811 17805 7ff71b414f08 11 API calls _get_daylight 17805->17806 17806->17792 17806->17805 17809 7ff71b41a8e0 37 API calls _invalid_parameter_noinfo 17806->17809 17807->17793 17808 7ff71b41a8e0 37 API calls _invalid_parameter_noinfo 17808->17811 17809->17806 17810->17793 17811->17790 17811->17792 17811->17804 17811->17808 17813 7ff71b423b13 17812->17813 17814 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17813->17814 17815 7ff71b423b3e memcpy_s 17813->17815 17814->17815 17815->17740 17817 7ff71b41e1d8 memcpy_s 17816->17817 17818 7ff71b4147c0 45 API calls 17817->17818 17819 7ff71b41e292 memcpy_s __scrt_get_show_window_mode 17817->17819 17818->17819 17819->17738 17821 7ff71b41df2b 17820->17821 17826 7ff71b41df78 memcpy_s 17820->17826 17822 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17821->17822 17823 7ff71b41df57 17822->17823 17823->17738 17824 7ff71b41dfe3 17825 7ff71b41a4a4 __std_exception_copy 37 API calls 17824->17825 17830 7ff71b41e025 memcpy_s 17825->17830 17826->17824 17827 7ff71b4147c0 45 API calls 17826->17827 17827->17824 17828 7ff71b41a900 _isindst 17 API calls 17829 7ff71b41e0d0 17828->17829 17830->17828 17832 7ff71b410c5f 17831->17832 17833 7ff71b410c4e 17831->17833 17832->17833 17834 7ff71b41d5fc _fread_nolock 12 API calls 17832->17834 17833->17667 17835 7ff71b410c90 17834->17835 17836 7ff71b410ca4 17835->17836 17837 7ff71b41a948 __free_lconv_num 11 API calls 17835->17837 17838 7ff71b41a948 __free_lconv_num 11 API calls 17836->17838 17837->17836 17838->17833 17840 7ff71b414766 17839->17840 17842 7ff71b41476e 17839->17842 17841 7ff71b4147c0 45 API calls 17840->17841 17841->17842 17842->17678 17844 7ff71b4147ff 17843->17844 17845 7ff71b41d9d1 17843->17845 17847 7ff71b41da24 17844->17847 17845->17844 17846 7ff71b423304 45 API calls 17845->17846 17846->17844 17848 7ff71b41da3d 17847->17848 17849 7ff71b41480f 17847->17849 17848->17849 17850 7ff71b422650 45 API calls 17848->17850 17849->17600 17850->17849 17854 7ff71b426d88 17851->17854 17857 7ff71b426dec 17854->17857 17855 7ff71b40c550 _log10_special 8 API calls 17856 7ff71b4200bd 17855->17856 17856->17693 17857->17855 17859 7ff71b410ffd 17858->17859 17860 7ff71b41100f 17858->17860 17861 7ff71b414f08 _get_daylight 11 API calls 17859->17861 17863 7ff71b41101d 17860->17863 17867 7ff71b411059 17860->17867 17862 7ff71b411002 17861->17862 17864 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 17862->17864 17865 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17863->17865 17872 7ff71b41100d 17864->17872 17865->17872 17866 7ff71b4113d5 17868 7ff71b414f08 _get_daylight 11 API calls 17866->17868 17866->17872 17867->17866 17869 7ff71b414f08 _get_daylight 11 API calls 17867->17869 17870 7ff71b411669 17868->17870 17871 7ff71b4113ca 17869->17871 17873 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 17870->17873 17874 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 17871->17874 17872->17565 17873->17872 17874->17866 17876 7ff71b410704 17875->17876 17903 7ff71b410464 17876->17903 17878 7ff71b41071d 17878->17218 17915 7ff71b4103bc 17879->17915 17883 7ff71b40c850 17882->17883 17884 7ff71b402930 GetCurrentProcessId 17883->17884 17885 7ff71b401c80 49 API calls 17884->17885 17886 7ff71b402979 17885->17886 17929 7ff71b414984 17886->17929 17891 7ff71b401c80 49 API calls 17892 7ff71b4029ff 17891->17892 17959 7ff71b402620 17892->17959 17895 7ff71b40c550 _log10_special 8 API calls 17896 7ff71b402a31 17895->17896 17896->17228 17898 7ff71b410119 17897->17898 17899 7ff71b401b89 17897->17899 17900 7ff71b414f08 _get_daylight 11 API calls 17898->17900 17899->17228 17899->17257 17901 7ff71b41011e 17900->17901 17902 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 17901->17902 17902->17899 17904 7ff71b4104ce 17903->17904 17905 7ff71b41048e 17903->17905 17904->17905 17907 7ff71b4104da 17904->17907 17906 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17905->17906 17913 7ff71b4104b5 17906->17913 17914 7ff71b41546c EnterCriticalSection 17907->17914 17913->17878 17916 7ff71b4103e6 17915->17916 17927 7ff71b401a20 17915->17927 17917 7ff71b410432 17916->17917 17920 7ff71b4103f5 __scrt_get_show_window_mode 17916->17920 17916->17927 17928 7ff71b41546c EnterCriticalSection 17917->17928 17921 7ff71b414f08 _get_daylight 11 API calls 17920->17921 17923 7ff71b41040a 17921->17923 17925 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 17923->17925 17925->17927 17927->17225 17927->17226 17931 7ff71b4149de 17929->17931 17930 7ff71b414a03 17932 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17930->17932 17931->17930 17933 7ff71b414a3f 17931->17933 17946 7ff71b414a2d 17932->17946 17968 7ff71b412c10 17933->17968 17936 7ff71b414b1c 17938 7ff71b41a948 __free_lconv_num 11 API calls 17936->17938 17937 7ff71b40c550 _log10_special 8 API calls 17939 7ff71b4029c3 17937->17939 17938->17946 17947 7ff71b415160 17939->17947 17940 7ff71b414b40 17940->17936 17942 7ff71b414b4a 17940->17942 17941 7ff71b414af1 17943 7ff71b41a948 __free_lconv_num 11 API calls 17941->17943 17945 7ff71b41a948 __free_lconv_num 11 API calls 17942->17945 17943->17946 17944 7ff71b414ae8 17944->17936 17944->17941 17945->17946 17946->17937 17948 7ff71b41b2c8 _get_daylight 11 API calls 17947->17948 17949 7ff71b415177 17948->17949 17950 7ff71b41eb98 _get_daylight 11 API calls 17949->17950 17952 7ff71b4151b7 17949->17952 17956 7ff71b4029e5 17949->17956 17951 7ff71b4151ac 17950->17951 17953 7ff71b41a948 __free_lconv_num 11 API calls 17951->17953 17952->17956 18103 7ff71b41ec20 17952->18103 17953->17952 17956->17891 17957 7ff71b41a900 _isindst 17 API calls 17958 7ff71b4151fc 17957->17958 17960 7ff71b40262f 17959->17960 17961 7ff71b409390 2 API calls 17960->17961 17962 7ff71b402660 17961->17962 17963 7ff71b402683 MessageBoxA 17962->17963 17964 7ff71b40266f MessageBoxW 17962->17964 17965 7ff71b402690 17963->17965 17964->17965 17966 7ff71b40c550 _log10_special 8 API calls 17965->17966 17967 7ff71b4026a0 17966->17967 17967->17895 17969 7ff71b412c4e 17968->17969 17970 7ff71b412c3e 17968->17970 17971 7ff71b412c57 17969->17971 17978 7ff71b412c85 17969->17978 17973 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17970->17973 17974 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17971->17974 17972 7ff71b412c7d 17972->17936 17972->17940 17972->17941 17972->17944 17973->17972 17974->17972 17975 7ff71b4147c0 45 API calls 17975->17978 17977 7ff71b412f34 17980 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 17977->17980 17978->17970 17978->17972 17978->17975 17978->17977 17982 7ff71b4135a0 17978->17982 18008 7ff71b413268 17978->18008 18038 7ff71b412af0 17978->18038 17980->17970 17983 7ff71b4135e2 17982->17983 17984 7ff71b413655 17982->17984 17987 7ff71b4135e8 17983->17987 17988 7ff71b41367f 17983->17988 17985 7ff71b41365a 17984->17985 17986 7ff71b4136af 17984->17986 17989 7ff71b41365c 17985->17989 17990 7ff71b41368f 17985->17990 17986->17988 17999 7ff71b4136be 17986->17999 18006 7ff71b413618 17986->18006 17995 7ff71b4135ed 17987->17995 17987->17999 18055 7ff71b411b50 17988->18055 17991 7ff71b4135fd 17989->17991 17998 7ff71b41366b 17989->17998 18062 7ff71b411740 17990->18062 18007 7ff71b4136ed 17991->18007 18041 7ff71b413f04 17991->18041 17995->17991 17997 7ff71b413630 17995->17997 17995->18006 17997->18007 18051 7ff71b4143c0 17997->18051 17998->17988 18000 7ff71b413670 17998->18000 17999->18007 18069 7ff71b411f60 17999->18069 18003 7ff71b414558 37 API calls 18000->18003 18000->18007 18002 7ff71b40c550 _log10_special 8 API calls 18004 7ff71b413983 18002->18004 18003->18006 18004->17978 18006->18007 18076 7ff71b41e858 18006->18076 18007->18002 18009 7ff71b413289 18008->18009 18010 7ff71b413273 18008->18010 18011 7ff71b4132c7 18009->18011 18014 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 18009->18014 18010->18011 18012 7ff71b4135e2 18010->18012 18013 7ff71b413655 18010->18013 18011->17978 18017 7ff71b4135e8 18012->18017 18018 7ff71b41367f 18012->18018 18015 7ff71b41365a 18013->18015 18016 7ff71b4136af 18013->18016 18014->18011 18019 7ff71b41365c 18015->18019 18020 7ff71b41368f 18015->18020 18016->18018 18029 7ff71b4136be 18016->18029 18036 7ff71b413618 18016->18036 18025 7ff71b4135ed 18017->18025 18017->18029 18022 7ff71b411b50 38 API calls 18018->18022 18021 7ff71b4135fd 18019->18021 18027 7ff71b41366b 18019->18027 18023 7ff71b411740 38 API calls 18020->18023 18024 7ff71b413f04 47 API calls 18021->18024 18035 7ff71b4136ed 18021->18035 18022->18036 18023->18036 18024->18036 18025->18021 18028 7ff71b413630 18025->18028 18025->18036 18026 7ff71b411f60 38 API calls 18026->18036 18027->18018 18030 7ff71b413670 18027->18030 18031 7ff71b4143c0 47 API calls 18028->18031 18028->18035 18029->18026 18029->18035 18033 7ff71b414558 37 API calls 18030->18033 18030->18035 18031->18036 18032 7ff71b40c550 _log10_special 8 API calls 18034 7ff71b413983 18032->18034 18033->18036 18034->17978 18035->18032 18036->18035 18037 7ff71b41e858 47 API calls 18036->18037 18037->18036 18086 7ff71b410d14 18038->18086 18042 7ff71b413f26 18041->18042 18043 7ff71b410b80 12 API calls 18042->18043 18044 7ff71b413f6e 18043->18044 18045 7ff71b41e570 46 API calls 18044->18045 18046 7ff71b414041 18045->18046 18047 7ff71b414063 18046->18047 18048 7ff71b4147c0 45 API calls 18046->18048 18049 7ff71b4147c0 45 API calls 18047->18049 18050 7ff71b4140ec 18047->18050 18048->18047 18049->18050 18050->18006 18052 7ff71b4143d8 18051->18052 18054 7ff71b414440 18051->18054 18053 7ff71b41e858 47 API calls 18052->18053 18052->18054 18053->18054 18054->18006 18056 7ff71b411b83 18055->18056 18057 7ff71b411bb2 18056->18057 18059 7ff71b411c6f 18056->18059 18058 7ff71b410b80 12 API calls 18057->18058 18061 7ff71b411bef 18057->18061 18058->18061 18060 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 18059->18060 18060->18061 18061->18006 18063 7ff71b411773 18062->18063 18064 7ff71b4117a2 18063->18064 18066 7ff71b41185f 18063->18066 18065 7ff71b410b80 12 API calls 18064->18065 18068 7ff71b4117df 18064->18068 18065->18068 18067 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 18066->18067 18067->18068 18068->18006 18070 7ff71b411f93 18069->18070 18071 7ff71b411fc2 18070->18071 18073 7ff71b41207f 18070->18073 18072 7ff71b410b80 12 API calls 18071->18072 18075 7ff71b411fff 18071->18075 18072->18075 18074 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 18073->18074 18074->18075 18075->18006 18077 7ff71b41e880 18076->18077 18078 7ff71b41e8c5 18077->18078 18079 7ff71b4147c0 45 API calls 18077->18079 18082 7ff71b41e885 __scrt_get_show_window_mode 18077->18082 18085 7ff71b41e8ae __scrt_get_show_window_mode 18077->18085 18081 7ff71b4207e8 WideCharToMultiByte 18078->18081 18078->18082 18078->18085 18079->18078 18080 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 18080->18082 18083 7ff71b41e9a1 18081->18083 18082->18006 18083->18082 18084 7ff71b41e9b6 GetLastError 18083->18084 18084->18082 18084->18085 18085->18080 18085->18082 18087 7ff71b410d41 18086->18087 18088 7ff71b410d53 18086->18088 18089 7ff71b414f08 _get_daylight 11 API calls 18087->18089 18091 7ff71b410d60 18088->18091 18095 7ff71b410d9d 18088->18095 18090 7ff71b410d46 18089->18090 18092 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 18090->18092 18093 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 18091->18093 18101 7ff71b410d51 18092->18101 18093->18101 18094 7ff71b410e46 18097 7ff71b414f08 _get_daylight 11 API calls 18094->18097 18094->18101 18095->18094 18096 7ff71b414f08 _get_daylight 11 API calls 18095->18096 18099 7ff71b410e3b 18096->18099 18098 7ff71b410ef0 18097->18098 18100 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 18098->18100 18102 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 18099->18102 18100->18101 18101->17978 18102->18094 18108 7ff71b41ec3d 18103->18108 18104 7ff71b41ec42 18105 7ff71b4151dd 18104->18105 18106 7ff71b414f08 _get_daylight 11 API calls 18104->18106 18105->17956 18105->17957 18107 7ff71b41ec4c 18106->18107 18109 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 18107->18109 18108->18104 18108->18105 18110 7ff71b41ec8c 18108->18110 18109->18105 18110->18105 18111 7ff71b414f08 _get_daylight 11 API calls 18110->18111 18111->18107 18113 7ff71b4085b1 GetTokenInformation 18112->18113 18114 7ff71b408633 __std_exception_copy 18112->18114 18115 7ff71b4085dd 18113->18115 18116 7ff71b4085d2 GetLastError 18113->18116 18117 7ff71b40864c 18114->18117 18118 7ff71b408646 CloseHandle 18114->18118 18115->18114 18119 7ff71b4085f9 GetTokenInformation 18115->18119 18116->18114 18116->18115 18117->17275 18118->18117 18119->18114 18120 7ff71b40861c 18119->18120 18120->18114 18121 7ff71b408626 ConvertSidToStringSidW 18120->18121 18121->18114 18123 7ff71b40c850 18122->18123 18124 7ff71b402b74 GetCurrentProcessId 18123->18124 18125 7ff71b4026b0 48 API calls 18124->18125 18126 7ff71b402bc7 18125->18126 18127 7ff71b414bd8 48 API calls 18126->18127 18128 7ff71b402c10 MessageBoxW 18127->18128 18129 7ff71b40c550 _log10_special 8 API calls 18128->18129 18130 7ff71b402c40 18129->18130 18130->17285 18132 7ff71b4025e5 18131->18132 18133 7ff71b414bd8 48 API calls 18132->18133 18134 7ff71b402604 18133->18134 18134->17301 18180 7ff71b418794 18135->18180 18139 7ff71b4081dc 18138->18139 18140 7ff71b409390 2 API calls 18139->18140 18141 7ff71b4081fb 18140->18141 18142 7ff71b408203 18141->18142 18143 7ff71b408216 ExpandEnvironmentStringsW 18141->18143 18144 7ff71b402810 49 API calls 18142->18144 18145 7ff71b40823c __std_exception_copy 18143->18145 18146 7ff71b40820f __std_exception_copy 18144->18146 18147 7ff71b408240 18145->18147 18148 7ff71b408253 18145->18148 18149 7ff71b40c550 _log10_special 8 API calls 18146->18149 18150 7ff71b402810 49 API calls 18147->18150 18152 7ff71b4082bf 18148->18152 18153 7ff71b408261 GetDriveTypeW 18148->18153 18151 7ff71b4083af 18149->18151 18150->18146 18151->17299 18170 7ff71b418238 18151->18170 18155 7ff71b417e08 45 API calls 18152->18155 18156 7ff71b4082b0 18153->18156 18157 7ff71b408295 18153->18157 18158 7ff71b4082d1 18155->18158 18303 7ff71b41796c 18156->18303 18159 7ff71b402810 49 API calls 18157->18159 18161 7ff71b4082d9 18158->18161 18168 7ff71b4082ec 18158->18168 18159->18146 18162 7ff71b402810 49 API calls 18161->18162 18162->18146 18163 7ff71b40834e CreateDirectoryW 18163->18146 18164 7ff71b4026b0 48 API calls 18168->18163 18168->18164 18171 7ff71b418258 18170->18171 18172 7ff71b418245 18170->18172 18319 7ff71b417ebc 18171->18319 18174 7ff71b414f08 _get_daylight 11 API calls 18172->18174 18221 7ff71b421558 18180->18221 18280 7ff71b4212d0 18221->18280 18301 7ff71b4202d8 EnterCriticalSection 18280->18301 18304 7ff71b41798a 18303->18304 18307 7ff71b4179bd 18303->18307 18304->18307 18310 7ff71b420474 18304->18310 18307->18146 18328 7ff71b40456a 18327->18328 18329 7ff71b409390 2 API calls 18328->18329 18330 7ff71b40458f 18329->18330 18331 7ff71b40c550 _log10_special 8 API calls 18330->18331 18332 7ff71b4045b7 18331->18332 18332->17337 18335 7ff71b407e2e 18333->18335 18334 7ff71b407f52 18337 7ff71b40c550 _log10_special 8 API calls 18334->18337 18335->18334 18336 7ff71b401c80 49 API calls 18335->18336 18341 7ff71b407eb5 18336->18341 18338 7ff71b407f83 18337->18338 18338->17337 18339 7ff71b401c80 49 API calls 18339->18341 18340 7ff71b404560 10 API calls 18340->18341 18341->18334 18341->18339 18341->18340 18342 7ff71b409390 2 API calls 18341->18342 18343 7ff71b407f23 CreateDirectoryW 18342->18343 18343->18334 18343->18341 18345 7ff71b401613 18344->18345 18346 7ff71b401637 18344->18346 18465 7ff71b401050 18345->18465 18348 7ff71b4045c0 108 API calls 18346->18348 18350 7ff71b40164b 18348->18350 18349 7ff71b401618 18353 7ff71b40162e 18349->18353 18356 7ff71b402710 54 API calls 18349->18356 18351 7ff71b401653 18350->18351 18352 7ff71b401682 18350->18352 18354 7ff71b414f08 _get_daylight 11 API calls 18351->18354 18355 7ff71b4045c0 108 API calls 18352->18355 18353->17337 18357 7ff71b401658 18354->18357 18358 7ff71b401696 18355->18358 18356->18353 18359 7ff71b402910 54 API calls 18357->18359 18360 7ff71b40169e 18358->18360 18361 7ff71b4016b8 18358->18361 18362 7ff71b401671 18359->18362 18363 7ff71b402710 54 API calls 18360->18363 18364 7ff71b4106d4 73 API calls 18361->18364 18362->17337 18365 7ff71b4016ae 18363->18365 18366 7ff71b4016cd 18364->18366 18371 7ff71b41004c 74 API calls 18365->18371 18367 7ff71b4016d1 18366->18367 18368 7ff71b4016f9 18366->18368 18372 7ff71b414f08 _get_daylight 11 API calls 18367->18372 18369 7ff71b4016ff 18368->18369 18370 7ff71b401717 18368->18370 18443 7ff71b401210 18369->18443 18377 7ff71b401739 18370->18377 18387 7ff71b401761 18370->18387 18375 7ff71b401829 18371->18375 18373 7ff71b4016d6 18372->18373 18376 7ff71b402910 54 API calls 18373->18376 18375->17337 18383 7ff71b4016ef __std_exception_copy 18376->18383 18379 7ff71b414f08 _get_daylight 11 API calls 18377->18379 18378 7ff71b41004c 74 API calls 18378->18365 18380 7ff71b40173e 18379->18380 18381 7ff71b41039c _fread_nolock 53 API calls 18381->18387 18383->18378 18384 7ff71b4017da 18386 7ff71b414f08 _get_daylight 11 API calls 18384->18386 18387->18381 18387->18383 18387->18384 18389 7ff71b4017c5 18387->18389 18496 7ff71b410adc 18387->18496 18391 7ff71b414f08 _get_daylight 11 API calls 18389->18391 18393 7ff71b407144 18392->18393 18394 7ff71b40718b 18392->18394 18393->18394 18529 7ff71b415024 18393->18529 18394->17337 18397 7ff71b4041a1 18396->18397 18398 7ff71b4044e0 49 API calls 18397->18398 18399 7ff71b4041db 18398->18399 18400 7ff71b4044e0 49 API calls 18399->18400 18401 7ff71b4041eb 18400->18401 18402 7ff71b40420d 18401->18402 18403 7ff71b40423c 18401->18403 18544 7ff71b404110 18402->18544 18404 7ff71b404110 51 API calls 18403->18404 18406 7ff71b40423a 18404->18406 18407 7ff71b40429c 18406->18407 18408 7ff71b404267 18406->18408 18410 7ff71b404110 51 API calls 18407->18410 18551 7ff71b407cf0 18408->18551 18412 7ff71b4042c0 18410->18412 18415 7ff71b404312 18412->18415 18417 7ff71b404110 51 API calls 18412->18417 18414 7ff71b404393 18418 7ff71b401950 115 API calls 18414->18418 18415->18414 18427 7ff71b40438c 18415->18427 18428 7ff71b404317 18415->18428 18431 7ff71b40437b 18415->18431 18420 7ff71b4042e9 18417->18420 18420->18415 18423 7ff71b404110 51 API calls 18420->18423 18423->18415 18424 7ff71b4043a5 18427->18424 18427->18428 18432 7ff71b402710 54 API calls 18428->18432 18441 7ff71b401c80 49 API calls 18440->18441 18442 7ff71b404474 18441->18442 18442->17337 18444 7ff71b401268 18443->18444 18445 7ff71b40126f 18444->18445 18446 7ff71b401297 18444->18446 18466 7ff71b4045c0 108 API calls 18465->18466 18467 7ff71b40108c 18466->18467 18468 7ff71b401094 18467->18468 18469 7ff71b4010a9 18467->18469 18470 7ff71b402710 54 API calls 18468->18470 18471 7ff71b4106d4 73 API calls 18469->18471 18477 7ff71b4010a4 __std_exception_copy 18470->18477 18472 7ff71b4010bf 18471->18472 18473 7ff71b4010e6 18472->18473 18474 7ff71b4010c3 18472->18474 18478 7ff71b401122 18473->18478 18479 7ff71b4010f7 18473->18479 18475 7ff71b414f08 _get_daylight 11 API calls 18474->18475 18476 7ff71b4010c8 18475->18476 18480 7ff71b402910 54 API calls 18476->18480 18477->18349 18482 7ff71b401129 18478->18482 18490 7ff71b40113c 18478->18490 18481 7ff71b414f08 _get_daylight 11 API calls 18479->18481 18487 7ff71b4010e1 __std_exception_copy 18480->18487 18483 7ff71b401100 18481->18483 18484 7ff71b401210 92 API calls 18482->18484 18485 7ff71b402910 54 API calls 18483->18485 18484->18487 18485->18487 18486 7ff71b41004c 74 API calls 18488 7ff71b4011b4 18486->18488 18487->18486 18488->18477 18500 7ff71b4046f0 18488->18500 18489 7ff71b41039c _fread_nolock 53 API calls 18489->18490 18490->18487 18490->18489 18492 7ff71b4011ed 18490->18492 18493 7ff71b414f08 _get_daylight 11 API calls 18492->18493 18494 7ff71b4011f2 18493->18494 18497 7ff71b410b0c 18496->18497 18530 7ff71b41505e 18529->18530 18531 7ff71b415031 18529->18531 18533 7ff71b415081 18530->18533 18534 7ff71b41509d 18530->18534 18532 7ff71b414f08 _get_daylight 11 API calls 18531->18532 18539 7ff71b414fe8 18531->18539 18535 7ff71b41503b 18532->18535 18536 7ff71b414f08 _get_daylight 11 API calls 18533->18536 18537 7ff71b414f4c 45 API calls 18534->18537 18538 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 18535->18538 18540 7ff71b415086 18536->18540 18543 7ff71b415091 18537->18543 18541 7ff71b415046 18538->18541 18539->18393 18542 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 18540->18542 18541->18393 18542->18543 18543->18393 18545 7ff71b404136 18544->18545 18546 7ff71b414984 49 API calls 18545->18546 18547 7ff71b40415c 18546->18547 18548 7ff71b40416d 18547->18548 18549 7ff71b404560 10 API calls 18547->18549 18548->18406 18550 7ff71b40417f 18549->18550 18550->18406 18552 7ff71b407d05 18551->18552 18553 7ff71b4045c0 108 API calls 18552->18553 18554 7ff71b407d2b 18553->18554 18555 7ff71b407d52 18554->18555 18556 7ff71b4045c0 108 API calls 18554->18556 18608 7ff71b415ec8 18607->18608 18609 7ff71b415eee 18608->18609 18611 7ff71b415f21 18608->18611 18610 7ff71b414f08 _get_daylight 11 API calls 18609->18610 18612 7ff71b415ef3 18610->18612 18614 7ff71b415f27 18611->18614 18615 7ff71b415f34 18611->18615 18613 7ff71b41a8e0 _invalid_parameter_noinfo 37 API calls 18612->18613 18616 7ff71b404616 18613->18616 18617 7ff71b414f08 _get_daylight 11 API calls 18614->18617 18626 7ff71b41ac28 18615->18626 18616->17363 18617->18616 18639 7ff71b4202d8 EnterCriticalSection 18626->18639 18999 7ff71b4178f8 18998->18999 19002 7ff71b4173d4 18999->19002 19001 7ff71b417911 19001->17373 19003 7ff71b41741e 19002->19003 19004 7ff71b4173ef 19002->19004 19012 7ff71b41546c EnterCriticalSection 19003->19012 19006 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 19004->19006 19008 7ff71b41740f 19006->19008 19008->19001 19014 7ff71b40fe71 19013->19014 19015 7ff71b40fe43 19013->19015 19017 7ff71b40fe63 19014->19017 19023 7ff71b41546c EnterCriticalSection 19014->19023 19016 7ff71b41a814 _invalid_parameter_noinfo 37 API calls 19015->19016 19016->19017 19017->17377 19025 7ff71b4045c0 108 API calls 19024->19025 19026 7ff71b401493 19025->19026 19027 7ff71b4014bc 19026->19027 19028 7ff71b40149b 19026->19028 19030 7ff71b4106d4 73 API calls 19027->19030 19029 7ff71b402710 54 API calls 19028->19029 19031 7ff71b4014ab 19029->19031 19032 7ff71b4014d1 19030->19032 19031->17410 19033 7ff71b4014d5 19032->19033 19034 7ff71b4014f8 19032->19034 19035 7ff71b414f08 _get_daylight 11 API calls 19033->19035 19038 7ff71b401532 19034->19038 19039 7ff71b401508 19034->19039 19036 7ff71b4014da 19035->19036 19037 7ff71b402910 54 API calls 19036->19037 19053 7ff71b4014f3 __std_exception_copy 19037->19053 19041 7ff71b40154b 19038->19041 19042 7ff71b401538 19038->19042 19040 7ff71b414f08 _get_daylight 11 API calls 19039->19040 19043 7ff71b401510 19040->19043 19048 7ff71b41039c _fread_nolock 53 API calls 19041->19048 19049 7ff71b4015d6 19041->19049 19041->19053 19044 7ff71b401210 92 API calls 19042->19044 19045 7ff71b402910 54 API calls 19043->19045 19044->19053 19045->19053 19046 7ff71b41004c 74 API calls 19048->19041 19050 7ff71b414f08 _get_daylight 11 API calls 19049->19050 19053->19046 19131 7ff71b406375 19130->19131 19132 7ff71b401c80 49 API calls 19131->19132 19133 7ff71b4063b1 19132->19133 19134 7ff71b4063dd 19133->19134 19135 7ff71b4063ba 19133->19135 19137 7ff71b404630 49 API calls 19134->19137 19136 7ff71b402710 54 API calls 19135->19136 19138 7ff71b4063d3 19136->19138 19139 7ff71b4063f5 19137->19139 19143 7ff71b40c550 _log10_special 8 API calls 19138->19143 19140 7ff71b406413 19139->19140 19141 7ff71b402710 54 API calls 19139->19141 19142 7ff71b404560 10 API calls 19140->19142 19141->19140 19144 7ff71b40641d 19142->19144 19145 7ff71b40336e 19143->19145 19146 7ff71b40642b 19144->19146 19147 7ff71b408e80 3 API calls 19144->19147 19145->17484 19161 7ff71b406500 19145->19161 19148 7ff71b404630 49 API calls 19146->19148 19147->19146 19149 7ff71b406444 19148->19149 19150 7ff71b406469 19149->19150 19151 7ff71b406449 19149->19151 19153 7ff71b408e80 3 API calls 19150->19153 19152 7ff71b402710 54 API calls 19151->19152 19152->19138 19310 7ff71b405400 19161->19310 19163 7ff71b406526 19164 7ff71b40653f 19163->19164 19165 7ff71b40652e 19163->19165 19312 7ff71b40542c 19310->19312 19311 7ff71b405434 19311->19163 19312->19311 19315 7ff71b4055d4 19312->19315 19341 7ff71b416aa4 19312->19341 19313 7ff71b405797 __std_exception_copy 19313->19163 19314 7ff71b4047d0 47 API calls 19314->19315 19315->19313 19315->19314 19342 7ff71b416ad4 19341->19342 19345 7ff71b415fa0 19342->19345 19403->17487 19405 7ff71b41b150 __GetCurrentState 45 API calls 19404->19405 19408 7ff71b41a3e1 19405->19408 19406 7ff71b41a504 __GetCurrentState 45 API calls 19407 7ff71b41a401 19406->19407 19408->19406

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 00007FF71B4089E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 0 7ff71b4089e0-7ff71b408b26 call 7ff71b40c850 call 7ff71b409390 SetConsoleCtrlHandler GetStartupInfoW call 7ff71b4153f0 call 7ff71b41a47c call 7ff71b41871c call 7ff71b4153f0 call 7ff71b41a47c call 7ff71b41871c call 7ff71b4153f0 call 7ff71b41a47c call 7ff71b41871c GetCommandLineW CreateProcessW 23 7ff71b408b28-7ff71b408b48 GetLastError call 7ff71b402c50 0->23 24 7ff71b408b4d-7ff71b408b89 RegisterClassW 0->24 32 7ff71b408e39-7ff71b408e5f call 7ff71b40c550 23->32 25 7ff71b408b8b GetLastError 24->25 26 7ff71b408b91-7ff71b408be5 CreateWindowExW 24->26 25->26 28 7ff71b408be7-7ff71b408bed GetLastError 26->28 29 7ff71b408bef-7ff71b408bf4 ShowWindow 26->29 31 7ff71b408bfa-7ff71b408c0a WaitForSingleObject 28->31 29->31 34 7ff71b408c88-7ff71b408c8f 31->34 35 7ff71b408c0c 31->35 38 7ff71b408c91-7ff71b408ca1 WaitForSingleObject 34->38 39 7ff71b408cd2-7ff71b408cd9 34->39 37 7ff71b408c10-7ff71b408c13 35->37 42 7ff71b408c1b-7ff71b408c22 37->42 43 7ff71b408c15 GetLastError 37->43 44 7ff71b408ca7-7ff71b408cb7 TerminateProcess 38->44 45 7ff71b408df8-7ff71b408e02 38->45 40 7ff71b408cdf-7ff71b408cf5 QueryPerformanceFrequency QueryPerformanceCounter 39->40 41 7ff71b408dc0-7ff71b408dd9 GetMessageW 39->41 46 7ff71b408d00-7ff71b408d38 MsgWaitForMultipleObjects PeekMessageW 40->46 48 7ff71b408ddb-7ff71b408de9 TranslateMessage DispatchMessageW 41->48 49 7ff71b408def-7ff71b408df6 41->49 42->38 47 7ff71b408c24-7ff71b408c41 PeekMessageW 42->47 43->42 52 7ff71b408cb9 GetLastError 44->52 53 7ff71b408cbf-7ff71b408ccd WaitForSingleObject 44->53 50 7ff71b408e11-7ff71b408e35 GetExitCodeProcess CloseHandle * 2 45->50 51 7ff71b408e04-7ff71b408e0a DestroyWindow 45->51 54 7ff71b408d3a 46->54 55 7ff71b408d73-7ff71b408d7a 46->55 56 7ff71b408c43-7ff71b408c74 TranslateMessage DispatchMessageW PeekMessageW 47->56 57 7ff71b408c76-7ff71b408c86 WaitForSingleObject 47->57 48->49 49->41 49->45 50->32 51->50 52->53 53->45 58 7ff71b408d40-7ff71b408d71 TranslateMessage DispatchMessageW PeekMessageW 54->58 55->41 59 7ff71b408d7c-7ff71b408da5 QueryPerformanceCounter 55->59 56->56 56->57 57->34 57->37 58->55 58->58 59->46 60 7ff71b408dab-7ff71b408db2 59->60 60->45 61 7ff71b408db4-7ff71b408db8 60->61 61->41
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                          • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                          • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                          • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                          • Instruction ID: f2bc795bb540bac58c2469dfd8de767840b931e7669fbc61dccd68a97225f65f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 43D15431A08E8286F710AF38E8542B9B760FF84768F909235DE5D436B5DF3CD5689750
                                                                                                                                                                                                                                          Function 00007FF71B401000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 62 7ff71b401000-7ff71b403806 call 7ff71b40fe18 call 7ff71b40fe20 call 7ff71b40c850 call 7ff71b4153f0 call 7ff71b415484 call 7ff71b4036b0 76 7ff71b403814-7ff71b403836 call 7ff71b401950 62->76 77 7ff71b403808-7ff71b40380f 62->77 82 7ff71b40383c-7ff71b403856 call 7ff71b401c80 76->82 83 7ff71b40391b-7ff71b403931 call 7ff71b4045c0 76->83 78 7ff71b403c97-7ff71b403cb2 call 7ff71b40c550 77->78 87 7ff71b40385b-7ff71b40389b call 7ff71b408830 82->87 90 7ff71b403933-7ff71b403960 call 7ff71b407f90 83->90 91 7ff71b40396a-7ff71b40397f call 7ff71b402710 83->91 97 7ff71b4038c1-7ff71b4038cc call 7ff71b414f30 87->97 98 7ff71b40389d-7ff71b4038a3 87->98 100 7ff71b403984-7ff71b4039a6 call 7ff71b401c80 90->100 101 7ff71b403962-7ff71b403965 call 7ff71b41004c 90->101 102 7ff71b403c8f 91->102 109 7ff71b4038d2-7ff71b4038e1 call 7ff71b408830 97->109 110 7ff71b4039fc-7ff71b403a2a call 7ff71b408940 call 7ff71b4089a0 * 3 97->110 103 7ff71b4038a5-7ff71b4038ad 98->103 104 7ff71b4038af-7ff71b4038bd call 7ff71b4089a0 98->104 115 7ff71b4039b0-7ff71b4039b9 100->115 101->91 102->78 103->104 104->97 119 7ff71b4039f4-7ff71b4039f7 call 7ff71b414f30 109->119 120 7ff71b4038e7-7ff71b4038ed 109->120 138 7ff71b403a2f-7ff71b403a3e call 7ff71b408830 110->138 115->115 118 7ff71b4039bb-7ff71b4039d8 call 7ff71b401950 115->118 118->87 130 7ff71b4039de-7ff71b4039ef call 7ff71b402710 118->130 119->110 124 7ff71b4038f0-7ff71b4038fc 120->124 127 7ff71b403905-7ff71b403908 124->127 128 7ff71b4038fe-7ff71b403903 124->128 127->119 131 7ff71b40390e-7ff71b403916 call 7ff71b414f30 127->131 128->124 128->127 130->102 131->138 141 7ff71b403b45-7ff71b403b53 138->141 142 7ff71b403a44-7ff71b403a47 138->142 143 7ff71b403b59-7ff71b403b5d 141->143 144 7ff71b403a67 141->144 142->141 145 7ff71b403a4d-7ff71b403a50 142->145 148 7ff71b403a6b-7ff71b403a90 call 7ff71b414f30 143->148 144->148 146 7ff71b403a56-7ff71b403a5a 145->146 147 7ff71b403b14-7ff71b403b17 145->147 146->147 149 7ff71b403a60 146->149 150 7ff71b403b2f-7ff71b403b40 call 7ff71b402710 147->150 151 7ff71b403b19-7ff71b403b1d 147->151 157 7ff71b403a92-7ff71b403aa6 call 7ff71b408940 148->157 158 7ff71b403aab-7ff71b403ac0 148->158 149->144 159 7ff71b403c7f-7ff71b403c87 150->159 151->150 153 7ff71b403b1f-7ff71b403b2a 151->153 153->148 157->158 161 7ff71b403ac6-7ff71b403aca 158->161 162 7ff71b403be8-7ff71b403bfa call 7ff71b408830 158->162 159->102 164 7ff71b403ad0-7ff71b403ae8 call 7ff71b415250 161->164 165 7ff71b403bcd-7ff71b403be2 call 7ff71b401940 161->165 170 7ff71b403c2e 162->170 171 7ff71b403bfc-7ff71b403c02 162->171 175 7ff71b403b62-7ff71b403b7a call 7ff71b415250 164->175 176 7ff71b403aea-7ff71b403b02 call 7ff71b415250 164->176 165->161 165->162 177 7ff71b403c31-7ff71b403c40 call 7ff71b414f30 170->177 173 7ff71b403c04-7ff71b403c1c 171->173 174 7ff71b403c1e-7ff71b403c2c 171->174 173->177 174->177 187 7ff71b403b7c-7ff71b403b80 175->187 188 7ff71b403b87-7ff71b403b9f call 7ff71b415250 175->188 176->165 184 7ff71b403b08-7ff71b403b0f 176->184 185 7ff71b403c46-7ff71b403c4a 177->185 186 7ff71b403d41-7ff71b403d63 call 7ff71b4044e0 177->186 184->165 189 7ff71b403cd4-7ff71b403ce6 call 7ff71b408830 185->189 190 7ff71b403c50-7ff71b403c5f call 7ff71b4090e0 185->190 201 7ff71b403d65-7ff71b403d6f call 7ff71b404630 186->201 202 7ff71b403d71-7ff71b403d82 call 7ff71b401c80 186->202 187->188 197 7ff71b403ba1-7ff71b403ba5 188->197 198 7ff71b403bac-7ff71b403bc4 call 7ff71b415250 188->198 206 7ff71b403d35-7ff71b403d3c 189->206 207 7ff71b403ce8-7ff71b403ceb 189->207 204 7ff71b403cb3-7ff71b403cb6 call 7ff71b408660 190->204 205 7ff71b403c61 190->205 197->198 198->165 217 7ff71b403bc6 198->217 215 7ff71b403d87-7ff71b403d96 201->215 202->215 216 7ff71b403cbb-7ff71b403cbd 204->216 212 7ff71b403c68 call 7ff71b402710 205->212 206->212 207->206 213 7ff71b403ced-7ff71b403d10 call 7ff71b401c80 207->213 225 7ff71b403c6d-7ff71b403c77 212->225 229 7ff71b403d12-7ff71b403d26 call 7ff71b402710 call 7ff71b414f30 213->229 230 7ff71b403d2b-7ff71b403d33 call 7ff71b414f30 213->230 220 7ff71b403dc4-7ff71b403dda call 7ff71b409390 215->220 221 7ff71b403d98-7ff71b403d9f 215->221 223 7ff71b403cbf-7ff71b403cc6 216->223 224 7ff71b403cc8-7ff71b403ccf 216->224 217->165 233 7ff71b403ddc 220->233 234 7ff71b403de8-7ff71b403e04 SetDllDirectoryW 220->234 221->220 227 7ff71b403da1-7ff71b403da5 221->227 223->212 224->215 225->159 227->220 231 7ff71b403da7-7ff71b403dbe SetDllDirectoryW LoadLibraryExW 227->231 229->225 230->215 231->220 233->234 237 7ff71b403f01-7ff71b403f08 234->237 238 7ff71b403e0a-7ff71b403e19 call 7ff71b408830 234->238 240 7ff71b403f0e-7ff71b403f15 237->240 241 7ff71b404008-7ff71b404010 237->241 251 7ff71b403e32-7ff71b403e3c call 7ff71b414f30 238->251 252 7ff71b403e1b-7ff71b403e21 238->252 240->241 244 7ff71b403f1b-7ff71b403f25 call 7ff71b4033c0 240->244 245 7ff71b404035-7ff71b404067 call 7ff71b4036a0 call 7ff71b403360 call 7ff71b403670 call 7ff71b406fc0 call 7ff71b406d70 241->245 246 7ff71b404012-7ff71b40402f PostMessageW GetMessageW 241->246 244->225 258 7ff71b403f2b-7ff71b403f3f call 7ff71b4090c0 244->258 246->245 263 7ff71b403ef2-7ff71b403efc call 7ff71b408940 251->263 264 7ff71b403e42-7ff71b403e48 251->264 255 7ff71b403e23-7ff71b403e2b 252->255 256 7ff71b403e2d-7ff71b403e2f 252->256 255->256 256->251 271 7ff71b403f64-7ff71b403f7a call 7ff71b408940 call 7ff71b4089e0 258->271 272 7ff71b403f41-7ff71b403f5e PostMessageW GetMessageW 258->272 263->237 264->263 265 7ff71b403e4e-7ff71b403e54 264->265 269 7ff71b403e56-7ff71b403e58 265->269 270 7ff71b403e5f-7ff71b403e61 265->270 274 7ff71b403e5a 269->274 275 7ff71b403e67-7ff71b403e83 call 7ff71b406dc0 call 7ff71b407340 269->275 270->237 270->275 286 7ff71b403f7f-7ff71b403fa7 call 7ff71b406fc0 call 7ff71b406d70 call 7ff71b4088e0 271->286 272->271 274->237 289 7ff71b403e85-7ff71b403e8c 275->289 290 7ff71b403e8e-7ff71b403e95 275->290 310 7ff71b403ff5-7ff71b404003 call 7ff71b401900 286->310 311 7ff71b403fa9-7ff71b403fbf call 7ff71b408ed0 call 7ff71b4088e0 286->311 293 7ff71b403edb-7ff71b403ef0 call 7ff71b402a50 call 7ff71b406fc0 call 7ff71b406d70 289->293 294 7ff71b403eaf-7ff71b403eb9 call 7ff71b4071b0 290->294 295 7ff71b403e97-7ff71b403ea4 call 7ff71b406e00 290->295 293->237 304 7ff71b403ec4-7ff71b403ed2 call 7ff71b4074f0 294->304 305 7ff71b403ebb-7ff71b403ec2 294->305 295->294 308 7ff71b403ea6-7ff71b403ead 295->308 304->237 318 7ff71b403ed4 304->318 305->293 308->293 310->225 311->310 323 7ff71b403fc1-7ff71b403fd6 311->323 318->293 324 7ff71b403ff0 call 7ff71b402a50 323->324 325 7ff71b403fd8-7ff71b403feb call 7ff71b402710 call 7ff71b401900 323->325 324->310 325->225
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                          • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                          • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                          • Opcode ID: 2d77af2a2f9236e5f1bda1603447cca491bc739d444c9c91c5f96d0c69afedc5
                                                                                                                                                                                                                                          • Instruction ID: a421a4f3469d78aa83552cf5b8d1ac695c1e98fa92933fea53ea955233f00496
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2d77af2a2f9236e5f1bda1603447cca491bc739d444c9c91c5f96d0c69afedc5
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 17327F21A1CE8251FA15B72D95943FAAA61AF48760FC4E032DE4D432E6DF2CE57CD360
                                                                                                                                                                                                                                          Function 00007FF71B425C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 479 7ff71b425c00-7ff71b425c3b call 7ff71b425588 call 7ff71b425590 call 7ff71b4255f8 486 7ff71b425c41-7ff71b425c4c call 7ff71b425598 479->486 487 7ff71b425e65-7ff71b425eb1 call 7ff71b41a900 call 7ff71b425588 call 7ff71b425590 call 7ff71b4255f8 479->487 486->487 492 7ff71b425c52-7ff71b425c5c 486->492 512 7ff71b425eb7-7ff71b425ec2 call 7ff71b425598 487->512 513 7ff71b425fef-7ff71b42605d call 7ff71b41a900 call 7ff71b421578 487->513 494 7ff71b425c7e-7ff71b425c82 492->494 495 7ff71b425c5e-7ff71b425c61 492->495 498 7ff71b425c85-7ff71b425c8d 494->498 497 7ff71b425c64-7ff71b425c6f 495->497 500 7ff71b425c7a-7ff71b425c7c 497->500 501 7ff71b425c71-7ff71b425c78 497->501 498->498 502 7ff71b425c8f-7ff71b425ca2 call 7ff71b41d5fc 498->502 500->494 504 7ff71b425cab-7ff71b425cb9 500->504 501->497 501->500 509 7ff71b425cba-7ff71b425cc6 call 7ff71b41a948 502->509 510 7ff71b425ca4-7ff71b425ca6 call 7ff71b41a948 502->510 520 7ff71b425ccd-7ff71b425cd5 509->520 510->504 512->513 522 7ff71b425ec8-7ff71b425ed3 call 7ff71b4255c8 512->522 533 7ff71b42606b-7ff71b42606e 513->533 534 7ff71b42605f-7ff71b426066 513->534 520->520 523 7ff71b425cd7-7ff71b425ce8 call 7ff71b420474 520->523 522->513 531 7ff71b425ed9-7ff71b425efc call 7ff71b41a948 GetTimeZoneInformation 522->531 523->487 532 7ff71b425cee-7ff71b425d44 call 7ff71b42a4d0 * 4 call 7ff71b425b1c 523->532 548 7ff71b425f02-7ff71b425f23 531->548 549 7ff71b425fc4-7ff71b425fee call 7ff71b425580 call 7ff71b425570 call 7ff71b425578 531->549 591 7ff71b425d46-7ff71b425d4a 532->591 538 7ff71b426070 533->538 539 7ff71b4260a5-7ff71b4260b8 call 7ff71b41d5fc 533->539 537 7ff71b4260fb-7ff71b4260fe 534->537 540 7ff71b426073 537->540 541 7ff71b426104-7ff71b42610c call 7ff71b425c00 537->541 538->540 555 7ff71b4260ba 539->555 556 7ff71b4260c3-7ff71b4260de call 7ff71b421578 539->556 545 7ff71b426078-7ff71b4260a4 call 7ff71b41a948 call 7ff71b40c550 540->545 546 7ff71b426073 call 7ff71b425e7c 540->546 541->545 546->545 553 7ff71b425f2e-7ff71b425f35 548->553 554 7ff71b425f25-7ff71b425f2b 548->554 561 7ff71b425f37-7ff71b425f3f 553->561 562 7ff71b425f49 553->562 554->553 560 7ff71b4260bc-7ff71b4260c1 call 7ff71b41a948 555->560 575 7ff71b4260e0-7ff71b4260e3 556->575 576 7ff71b4260e5-7ff71b4260f7 call 7ff71b41a948 556->576 560->538 561->562 570 7ff71b425f41-7ff71b425f47 561->570 573 7ff71b425f4b-7ff71b425fbf call 7ff71b42a4d0 * 4 call 7ff71b422b5c call 7ff71b426114 * 2 562->573 570->573 573->549 575->560 576->537 593 7ff71b425d4c 591->593 594 7ff71b425d50-7ff71b425d54 591->594 593->594 594->591 596 7ff71b425d56-7ff71b425d7b call 7ff71b416b58 594->596 602 7ff71b425d7e-7ff71b425d82 596->602 604 7ff71b425d91-7ff71b425d95 602->604 605 7ff71b425d84-7ff71b425d8f 602->605 604->602 605->604 607 7ff71b425d97-7ff71b425d9b 605->607 610 7ff71b425e1c-7ff71b425e20 607->610 611 7ff71b425d9d-7ff71b425dc5 call 7ff71b416b58 607->611 612 7ff71b425e27-7ff71b425e34 610->612 613 7ff71b425e22-7ff71b425e24 610->613 618 7ff71b425dc7 611->618 619 7ff71b425de3-7ff71b425de7 611->619 615 7ff71b425e4f-7ff71b425e5e call 7ff71b425580 call 7ff71b425570 612->615 616 7ff71b425e36-7ff71b425e4c call 7ff71b425b1c 612->616 613->612 615->487 616->615 622 7ff71b425dca-7ff71b425dd1 618->622 619->610 624 7ff71b425de9-7ff71b425e07 call 7ff71b416b58 619->624 622->619 626 7ff71b425dd3-7ff71b425de1 622->626 631 7ff71b425e13-7ff71b425e1a 624->631 626->619 626->622 631->610 632 7ff71b425e09-7ff71b425e0d 631->632 632->610 633 7ff71b425e0f 632->633 633->631
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF71B425C45
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B425598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71B4255AC
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B41A948: RtlFreeHeap.NTDLL(?,?,?,00007FF71B422D22,?,?,?,00007FF71B422D5F,?,?,00000000,00007FF71B423225,?,?,?,00007FF71B423157), ref: 00007FF71B41A95E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B41A948: GetLastError.KERNEL32(?,?,?,00007FF71B422D22,?,?,?,00007FF71B422D5F,?,?,00000000,00007FF71B423225,?,?,?,00007FF71B423157), ref: 00007FF71B41A968
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B41A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF71B41A8DF,?,?,?,?,?,00007FF71B41A7CA), ref: 00007FF71B41A909
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B41A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF71B41A8DF,?,?,?,?,?,00007FF71B41A7CA), ref: 00007FF71B41A92E
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF71B425C34
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B4255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71B42560C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF71B425EAA
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF71B425EBB
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF71B425ECC
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF71B42610C), ref: 00007FF71B425EF3
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                          • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                          • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                          • Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                          • Instruction ID: c2e68ef5f2ea50beb823ea1ca6c53c74e8d794eb2521fc925d72fdf99d8df17e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AFD10632E18A1246E720FF29E4401B9A351FF847A4FC4E075EE0E476A5DF3CE46997A0
                                                                                                                                                                                                                                          Function 00007FF71B426964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 693 7ff71b426964-7ff71b4269d7 call 7ff71b426698 696 7ff71b4269d9-7ff71b4269e2 call 7ff71b414ee8 693->696 697 7ff71b4269f1-7ff71b4269fb call 7ff71b418520 693->697 704 7ff71b4269e5-7ff71b4269ec call 7ff71b414f08 696->704 702 7ff71b4269fd-7ff71b426a14 call 7ff71b414ee8 call 7ff71b414f08 697->702 703 7ff71b426a16-7ff71b426a7f CreateFileW 697->703 702->704 707 7ff71b426afc-7ff71b426b07 GetFileType 703->707 708 7ff71b426a81-7ff71b426a87 703->708 715 7ff71b426d32-7ff71b426d52 704->715 710 7ff71b426b5a-7ff71b426b61 707->710 711 7ff71b426b09-7ff71b426b44 GetLastError call 7ff71b414e7c CloseHandle 707->711 713 7ff71b426ac9-7ff71b426af7 GetLastError call 7ff71b414e7c 708->713 714 7ff71b426a89-7ff71b426a8d 708->714 718 7ff71b426b69-7ff71b426b6c 710->718 719 7ff71b426b63-7ff71b426b67 710->719 711->704 727 7ff71b426b4a-7ff71b426b55 call 7ff71b414f08 711->727 713->704 714->713 720 7ff71b426a8f-7ff71b426ac7 CreateFileW 714->720 725 7ff71b426b72-7ff71b426bc7 call 7ff71b418438 718->725 726 7ff71b426b6e 718->726 719->725 720->707 720->713 732 7ff71b426bc9-7ff71b426bd5 call 7ff71b4268a0 725->732 733 7ff71b426be6-7ff71b426c17 call 7ff71b426418 725->733 726->725 727->704 732->733 738 7ff71b426bd7 732->738 739 7ff71b426c19-7ff71b426c1b 733->739 740 7ff71b426c1d-7ff71b426c5f 733->740 741 7ff71b426bd9-7ff71b426be1 call 7ff71b41aac0 738->741 739->741 742 7ff71b426c81-7ff71b426c8c 740->742 743 7ff71b426c61-7ff71b426c65 740->743 741->715 746 7ff71b426d30 742->746 747 7ff71b426c92-7ff71b426c96 742->747 743->742 745 7ff71b426c67-7ff71b426c7c 743->745 745->742 746->715 747->746 749 7ff71b426c9c-7ff71b426ce1 CloseHandle CreateFileW 747->749 750 7ff71b426ce3-7ff71b426d11 GetLastError call 7ff71b414e7c call 7ff71b418660 749->750 751 7ff71b426d16-7ff71b426d2b 749->751 750->751 751->746
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1617910340-0
                                                                                                                                                                                                                                          • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                          • Instruction ID: 020123e67c0cfe698102a89349b01edca419ae69b8ff88d1dafe1c757132a9c5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 83C1D436B24E4185EB10DF69D4902BC7761F749BA8F51A235EE1E973A4CF38E029D710
                                                                                                                                                                                                                                          Function 00007FF71B425E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 959 7ff71b425e7c-7ff71b425eb1 call 7ff71b425588 call 7ff71b425590 call 7ff71b4255f8 966 7ff71b425eb7-7ff71b425ec2 call 7ff71b425598 959->966 967 7ff71b425fef-7ff71b42605d call 7ff71b41a900 call 7ff71b421578 959->967 966->967 972 7ff71b425ec8-7ff71b425ed3 call 7ff71b4255c8 966->972 979 7ff71b42606b-7ff71b42606e 967->979 980 7ff71b42605f-7ff71b426066 967->980 972->967 978 7ff71b425ed9-7ff71b425efc call 7ff71b41a948 GetTimeZoneInformation 972->978 992 7ff71b425f02-7ff71b425f23 978->992 993 7ff71b425fc4-7ff71b425fee call 7ff71b425580 call 7ff71b425570 call 7ff71b425578 978->993 983 7ff71b426070 979->983 984 7ff71b4260a5-7ff71b4260b8 call 7ff71b41d5fc 979->984 982 7ff71b4260fb-7ff71b4260fe 980->982 985 7ff71b426073 982->985 986 7ff71b426104-7ff71b42610c call 7ff71b425c00 982->986 983->985 998 7ff71b4260ba 984->998 999 7ff71b4260c3-7ff71b4260de call 7ff71b421578 984->999 989 7ff71b426078-7ff71b4260a4 call 7ff71b41a948 call 7ff71b40c550 985->989 990 7ff71b426073 call 7ff71b425e7c 985->990 986->989 990->989 996 7ff71b425f2e-7ff71b425f35 992->996 997 7ff71b425f25-7ff71b425f2b 992->997 1003 7ff71b425f37-7ff71b425f3f 996->1003 1004 7ff71b425f49 996->1004 997->996 1002 7ff71b4260bc-7ff71b4260c1 call 7ff71b41a948 998->1002 1015 7ff71b4260e0-7ff71b4260e3 999->1015 1016 7ff71b4260e5-7ff71b4260f7 call 7ff71b41a948 999->1016 1002->983 1003->1004 1011 7ff71b425f41-7ff71b425f47 1003->1011 1013 7ff71b425f4b-7ff71b425fbf call 7ff71b42a4d0 * 4 call 7ff71b422b5c call 7ff71b426114 * 2 1004->1013 1011->1013 1013->993 1015->1002 1016->982
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF71B425EAA
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B4255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71B42560C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF71B425EBB
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B425598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71B4255AC
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF71B425ECC
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B4255C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71B4255DC
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B41A948: RtlFreeHeap.NTDLL(?,?,?,00007FF71B422D22,?,?,?,00007FF71B422D5F,?,?,00000000,00007FF71B423225,?,?,?,00007FF71B423157), ref: 00007FF71B41A95E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B41A948: GetLastError.KERNEL32(?,?,?,00007FF71B422D22,?,?,?,00007FF71B422D5F,?,?,00000000,00007FF71B423225,?,?,?,00007FF71B423157), ref: 00007FF71B41A968
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF71B42610C), ref: 00007FF71B425EF3
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                          • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                          • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                          • Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                          • Instruction ID: 15927e38c67323c4bd7433a113e4ff891904fadd3e1b74451c344d48894d7814
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 81518231A08A4246E710FF29E4811B9E360FB487A4FC5E175EE0E436B5DF3CE4689760
                                                                                                                                                                                                                                          Function 00007FF71B409280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                                                          • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                          • Instruction ID: d3a3855bd1d7567c0ceb151ad8a7af6530904a4861dab57d2c20963030914afd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A8F0C826A1CB4286F7609B68B4987B6B350EB84774F845739DD6D026E4DF3CD06CCA14
                                                                                                                                                                                                                                          Function 00007FF71B4208C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1010374628-0
                                                                                                                                                                                                                                          • Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
                                                                                                                                                                                                                                          • Instruction ID: 7404518bc7b8109e4012556ba7b3d27971aa42bd59d52ac7524c434732836402
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2902E121F2DE4640FA65BB19A400238E6E2AF49BB0FD5E574DD6D463F1DE3CA4689320
                                                                                                                                                                                                                                          Function 00007FF71B401950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 331 7ff71b401950-7ff71b40198b call 7ff71b4045c0 334 7ff71b401991-7ff71b4019d1 call 7ff71b407f90 331->334 335 7ff71b401c4e-7ff71b401c72 call 7ff71b40c550 331->335 340 7ff71b401c3b-7ff71b401c3e call 7ff71b41004c 334->340 341 7ff71b4019d7-7ff71b4019e7 call 7ff71b4106d4 334->341 345 7ff71b401c43-7ff71b401c4b 340->345 346 7ff71b4019e9-7ff71b401a03 call 7ff71b414f08 call 7ff71b402910 341->346 347 7ff71b401a08-7ff71b401a24 call 7ff71b41039c 341->347 345->335 346->340 352 7ff71b401a26-7ff71b401a40 call 7ff71b414f08 call 7ff71b402910 347->352 353 7ff71b401a45-7ff71b401a5a call 7ff71b414f28 347->353 352->340 361 7ff71b401a5c-7ff71b401a76 call 7ff71b414f08 call 7ff71b402910 353->361 362 7ff71b401a7b-7ff71b401b05 call 7ff71b401c80 * 2 call 7ff71b4106d4 call 7ff71b414f44 353->362 361->340 375 7ff71b401b0a-7ff71b401b14 362->375 376 7ff71b401b16-7ff71b401b30 call 7ff71b414f08 call 7ff71b402910 375->376 377 7ff71b401b35-7ff71b401b4e call 7ff71b41039c 375->377 376->340 382 7ff71b401b50-7ff71b401b6a call 7ff71b414f08 call 7ff71b402910 377->382 383 7ff71b401b6f-7ff71b401b8b call 7ff71b410110 377->383 382->340 391 7ff71b401b9e-7ff71b401bac 383->391 392 7ff71b401b8d-7ff71b401b99 call 7ff71b402710 383->392 391->340 395 7ff71b401bb2-7ff71b401bb9 391->395 392->340 397 7ff71b401bc1-7ff71b401bc7 395->397 398 7ff71b401be0-7ff71b401bef 397->398 399 7ff71b401bc9-7ff71b401bd6 397->399 398->398 400 7ff71b401bf1-7ff71b401bfa 398->400 399->400 401 7ff71b401c0f 400->401 402 7ff71b401bfc-7ff71b401bff 400->402 404 7ff71b401c11-7ff71b401c24 401->404 402->401 403 7ff71b401c01-7ff71b401c04 402->403 403->401 405 7ff71b401c06-7ff71b401c09 403->405 406 7ff71b401c26 404->406 407 7ff71b401c2d-7ff71b401c39 404->407 405->401 408 7ff71b401c0b-7ff71b401c0d 405->408 406->407 407->340 407->397 408->404
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B407F90: _fread_nolock.LIBCMT ref: 00007FF71B40803A
                                                                                                                                                                                                                                          • _fread_nolock.LIBCMT ref: 00007FF71B401A1B
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B402910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF71B401B6A), ref: 00007FF71B40295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                          • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                          • Opcode ID: 507f08f26e205d920f148b85cad333997b9676a31346628d4d7d58e95cedc463
                                                                                                                                                                                                                                          • Instruction ID: ca2b0378ee88f7daf0743f2a762409e49d511c0a750a2b81f0aad096eff0818b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 507f08f26e205d920f148b85cad333997b9676a31346628d4d7d58e95cedc463
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67819371A0CE8685EB20EB19E0402F9B3A0EF88754F94E435ED8D477A5DE3CE56D8760
                                                                                                                                                                                                                                          Function 00007FF71B401600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 409 7ff71b401600-7ff71b401611 410 7ff71b401613-7ff71b40161c call 7ff71b401050 409->410 411 7ff71b401637-7ff71b401651 call 7ff71b4045c0 409->411 418 7ff71b40162e-7ff71b401636 410->418 419 7ff71b40161e-7ff71b401629 call 7ff71b402710 410->419 416 7ff71b401653-7ff71b401681 call 7ff71b414f08 call 7ff71b402910 411->416 417 7ff71b401682-7ff71b40169c call 7ff71b4045c0 411->417 426 7ff71b40169e-7ff71b4016b3 call 7ff71b402710 417->426 427 7ff71b4016b8-7ff71b4016cf call 7ff71b4106d4 417->427 419->418 433 7ff71b401821-7ff71b401824 call 7ff71b41004c 426->433 434 7ff71b4016d1-7ff71b4016f4 call 7ff71b414f08 call 7ff71b402910 427->434 435 7ff71b4016f9-7ff71b4016fd 427->435 443 7ff71b401829-7ff71b40183b 433->443 448 7ff71b401819-7ff71b40181c call 7ff71b41004c 434->448 436 7ff71b4016ff-7ff71b40170b call 7ff71b401210 435->436 437 7ff71b401717-7ff71b401737 call 7ff71b414f44 435->437 445 7ff71b401710-7ff71b401712 436->445 449 7ff71b401761-7ff71b40176c 437->449 450 7ff71b401739-7ff71b40175c call 7ff71b414f08 call 7ff71b402910 437->450 445->448 448->433 451 7ff71b401802-7ff71b40180a call 7ff71b414f30 449->451 452 7ff71b401772-7ff71b401777 449->452 462 7ff71b40180f-7ff71b401814 450->462 451->462 455 7ff71b401780-7ff71b4017a2 call 7ff71b41039c 452->455 464 7ff71b4017a4-7ff71b4017bc call 7ff71b410adc 455->464 465 7ff71b4017da-7ff71b4017e6 call 7ff71b414f08 455->465 462->448 470 7ff71b4017c5-7ff71b4017d8 call 7ff71b414f08 464->470 471 7ff71b4017be-7ff71b4017c1 464->471 472 7ff71b4017ed-7ff71b4017f8 call 7ff71b402910 465->472 470->472 471->455 474 7ff71b4017c3 471->474 477 7ff71b4017fd 472->477 474->477 477->451
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                          • Opcode ID: 1024a7a5ee8cd7a3c756baff70d017aadc137d22fcd9cea75d224d6f76c21f88
                                                                                                                                                                                                                                          • Instruction ID: a50aa53107ce5008232e7a710971c7df12a4f33ca8a49af9ee3efc768109b017
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1024a7a5ee8cd7a3c756baff70d017aadc137d22fcd9cea75d224d6f76c21f88
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 14517161B08E4682EA10BB5AA4101E9A3A0BF847B4FD4A531EE4C477F5DE3CF56D9720
                                                                                                                                                                                                                                          Function 00007FF71B408660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(?,?,00000000,00007FF71B403CBB), ref: 00007FF71B408704
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00007FF71B403CBB), ref: 00007FF71B40870A
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNELBASE(?,00000000,00007FF71B403CBB), ref: 00007FF71B40874C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B408830: GetEnvironmentVariableW.KERNEL32(00007FF71B40388E), ref: 00007FF71B408867
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B408830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF71B408889
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B418238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71B418251
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B402810: MessageBoxW.USER32 ref: 00007FF71B4028EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                          • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                          • Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                          • Instruction ID: 8782c80e7c113ca6e70dc7e7464e310e77ba4a16e1721216ddb3a991b8e51504
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EE419F11A19E4244FA14B72DAA552F99390AF887E0FD0E131ED4D477FADE3CE52DC620
                                                                                                                                                                                                                                          Function 00007FF71B401210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 756 7ff71b401210-7ff71b40126d call 7ff71b40bd80 759 7ff71b40126f-7ff71b401296 call 7ff71b402710 756->759 760 7ff71b401297-7ff71b4012af call 7ff71b414f44 756->760 765 7ff71b4012d4-7ff71b4012e4 call 7ff71b414f44 760->765 766 7ff71b4012b1-7ff71b4012cf call 7ff71b414f08 call 7ff71b402910 760->766 772 7ff71b4012e6-7ff71b401304 call 7ff71b414f08 call 7ff71b402910 765->772 773 7ff71b401309-7ff71b40131b 765->773 777 7ff71b401439-7ff71b40144e call 7ff71b40ba60 call 7ff71b414f30 * 2 766->777 772->777 776 7ff71b401320-7ff71b401345 call 7ff71b41039c 773->776 785 7ff71b401431 776->785 786 7ff71b40134b-7ff71b401355 call 7ff71b410110 776->786 793 7ff71b401453-7ff71b40146d 777->793 785->777 786->785 792 7ff71b40135b-7ff71b401367 786->792 794 7ff71b401370-7ff71b401398 call 7ff71b40a1c0 792->794 797 7ff71b401416-7ff71b40142c call 7ff71b402710 794->797 798 7ff71b40139a-7ff71b40139d 794->798 797->785 799 7ff71b401411 798->799 800 7ff71b40139f-7ff71b4013a9 798->800 799->797 802 7ff71b4013d4-7ff71b4013d7 800->802 803 7ff71b4013ab-7ff71b4013b9 call 7ff71b410adc 800->803 805 7ff71b4013ea-7ff71b4013ef 802->805 806 7ff71b4013d9-7ff71b4013e7 call 7ff71b429e30 802->806 809 7ff71b4013be-7ff71b4013c1 803->809 805->794 808 7ff71b4013f5-7ff71b4013f8 805->808 806->805 811 7ff71b40140c-7ff71b40140f 808->811 812 7ff71b4013fa-7ff71b4013fd 808->812 813 7ff71b4013c3-7ff71b4013cd call 7ff71b410110 809->813 814 7ff71b4013cf-7ff71b4013d2 809->814 811->785 812->797 815 7ff71b4013ff-7ff71b401407 812->815 813->805 813->814 814->797 815->776
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                          • Opcode ID: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
                                                                                                                                                                                                                                          • Instruction ID: bf2066286f234e470e9f065fb2856391d5f7552f2b3752bc74388d74dd544001
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D51C522A08E5245E620BB1AA4403FAE291FF847A4FD4A135FD4D477F5EE3CE569C710
                                                                                                                                                                                                                                          Function 00007FF71B4036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,00007FF71B403804), ref: 00007FF71B4036E1
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B403804), ref: 00007FF71B4036EB
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B402C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF71B403706,?,00007FF71B403804), ref: 00007FF71B402C9E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B402C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF71B403706,?,00007FF71B403804), ref: 00007FF71B402D63
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B402C50: MessageBoxW.USER32 ref: 00007FF71B402D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                          • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                          • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                          • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                          • Instruction ID: 3353bda715af4eb6ab9ca3a30b5a7cd569479944f5b8e43c28389254006d5e68
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2214F51B1CE4251FA20B728E8503F6A260AF88364FC0E135DD9D825F6EE2CE52C8764
                                                                                                                                                                                                                                          Function 00007FF71B41BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 846 7ff71b41ba5c-7ff71b41ba82 847 7ff71b41ba9d-7ff71b41baa1 846->847 848 7ff71b41ba84-7ff71b41ba98 call 7ff71b414ee8 call 7ff71b414f08 846->848 850 7ff71b41be77-7ff71b41be83 call 7ff71b414ee8 call 7ff71b414f08 847->850 851 7ff71b41baa7-7ff71b41baae 847->851 862 7ff71b41be8e 848->862 869 7ff71b41be89 call 7ff71b41a8e0 850->869 851->850 853 7ff71b41bab4-7ff71b41bae2 851->853 853->850 856 7ff71b41bae8-7ff71b41baef 853->856 859 7ff71b41bb08-7ff71b41bb0b 856->859 860 7ff71b41baf1-7ff71b41bb03 call 7ff71b414ee8 call 7ff71b414f08 856->860 865 7ff71b41bb11-7ff71b41bb17 859->865 866 7ff71b41be73-7ff71b41be75 859->866 860->869 867 7ff71b41be91-7ff71b41bea8 862->867 865->866 870 7ff71b41bb1d-7ff71b41bb20 865->870 866->867 869->862 870->860 871 7ff71b41bb22-7ff71b41bb47 870->871 874 7ff71b41bb7a-7ff71b41bb81 871->874 875 7ff71b41bb49-7ff71b41bb4b 871->875 879 7ff71b41bb83-7ff71b41bbab call 7ff71b41d5fc call 7ff71b41a948 * 2 874->879 880 7ff71b41bb56-7ff71b41bb6d call 7ff71b414ee8 call 7ff71b414f08 call 7ff71b41a8e0 874->880 877 7ff71b41bb4d-7ff71b41bb54 875->877 878 7ff71b41bb72-7ff71b41bb78 875->878 877->878 877->880 882 7ff71b41bbf8-7ff71b41bc0f 878->882 907 7ff71b41bbc8-7ff71b41bbf3 call 7ff71b41c284 879->907 908 7ff71b41bbad-7ff71b41bbc3 call 7ff71b414f08 call 7ff71b414ee8 879->908 911 7ff71b41bd00 880->911 885 7ff71b41bc8a-7ff71b41bc94 call 7ff71b42391c 882->885 886 7ff71b41bc11-7ff71b41bc19 882->886 898 7ff71b41bc9a-7ff71b41bcaf 885->898 899 7ff71b41bd1e 885->899 886->885 890 7ff71b41bc1b-7ff71b41bc1d 886->890 890->885 895 7ff71b41bc1f-7ff71b41bc35 890->895 895->885 900 7ff71b41bc37-7ff71b41bc43 895->900 898->899 905 7ff71b41bcb1-7ff71b41bcc3 GetConsoleMode 898->905 903 7ff71b41bd23-7ff71b41bd43 ReadFile 899->903 900->885 901 7ff71b41bc45-7ff71b41bc47 900->901 901->885 906 7ff71b41bc49-7ff71b41bc61 901->906 909 7ff71b41bd49-7ff71b41bd51 903->909 910 7ff71b41be3d-7ff71b41be46 GetLastError 903->910 905->899 912 7ff71b41bcc5-7ff71b41bccd 905->912 906->885 914 7ff71b41bc63-7ff71b41bc6f 906->914 907->882 908->911 909->910 916 7ff71b41bd57 909->916 919 7ff71b41be48-7ff71b41be5e call 7ff71b414f08 call 7ff71b414ee8 910->919 920 7ff71b41be63-7ff71b41be66 910->920 913 7ff71b41bd03-7ff71b41bd0d call 7ff71b41a948 911->913 912->903 918 7ff71b41bccf-7ff71b41bcf1 ReadConsoleW 912->918 913->867 914->885 922 7ff71b41bc71-7ff71b41bc73 914->922 926 7ff71b41bd5e-7ff71b41bd73 916->926 928 7ff71b41bd12-7ff71b41bd1c 918->928 929 7ff71b41bcf3 GetLastError 918->929 919->911 923 7ff71b41bcf9-7ff71b41bcfb call 7ff71b414e7c 920->923 924 7ff71b41be6c-7ff71b41be6e 920->924 922->885 933 7ff71b41bc75-7ff71b41bc85 922->933 923->911 924->913 926->913 935 7ff71b41bd75-7ff71b41bd80 926->935 928->926 929->923 933->885 939 7ff71b41bda7-7ff71b41bdaf 935->939 940 7ff71b41bd82-7ff71b41bd9b call 7ff71b41b674 935->940 943 7ff71b41be2b-7ff71b41be38 call 7ff71b41b4b4 939->943 944 7ff71b41bdb1-7ff71b41bdc3 939->944 946 7ff71b41bda0-7ff71b41bda2 940->946 943->946 947 7ff71b41be1e-7ff71b41be26 944->947 948 7ff71b41bdc5 944->948 946->913 947->913 949 7ff71b41bdca-7ff71b41bdd1 948->949 951 7ff71b41be0d-7ff71b41be18 949->951 952 7ff71b41bdd3-7ff71b41bdd7 949->952 951->947 953 7ff71b41bdd9-7ff71b41bde0 952->953 954 7ff71b41bdf3 952->954 953->954 955 7ff71b41bde2-7ff71b41bde6 953->955 956 7ff71b41bdf9-7ff71b41be09 954->956 955->954 957 7ff71b41bde8-7ff71b41bdf1 955->957 956->949 958 7ff71b41be0b 956->958 957->956 958->947
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                          • Instruction ID: d0c153ed90200404ab3f268aaf7e6ad6c901ce4a28756ce04fa57b983e652e4c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 99C1C222E08F8691E660AB1D94402BDA651EBC1BA0FE5E135EE4D437A1DE7CF46D8720
                                                                                                                                                                                                                                          Function 00007FF71B408570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 995526605-0
                                                                                                                                                                                                                                          • Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                          • Instruction ID: 85f838c14f96d9b44f6e05c36b5a1628cd038ae513fb3e5a8fada07e452fdf75
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 30214131A0CE4242EA10AB5DB58427AE3A0EB857B4F909635EE6D83BF4DE6CD4598710
                                                                                                                                                                                                                                          Function 00007FF71B4090E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B408570: GetCurrentProcess.KERNEL32 ref: 00007FF71B408590
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B408570: OpenProcessToken.ADVAPI32 ref: 00007FF71B4085A3
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B408570: GetTokenInformation.KERNELBASE ref: 00007FF71B4085C8
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B408570: GetLastError.KERNEL32 ref: 00007FF71B4085D2
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B408570: GetTokenInformation.KERNELBASE ref: 00007FF71B408612
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B408570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF71B40862E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B408570: CloseHandle.KERNEL32 ref: 00007FF71B408646
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF71B403C55), ref: 00007FF71B40916C
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF71B403C55), ref: 00007FF71B409175
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                          • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                          • Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
                                                                                                                                                                                                                                          • Instruction ID: 9a00782e5c6a816d54a8689f9ec0b63213453cc55c0bfd801453ecc3aff29b27
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D214F25A08F4281F610BB18E5157FAA260FF88790FD4A435EE4D477E6DF3CD8598760
                                                                                                                                                                                                                                          Function 00007FF71B407E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNELBASE(00000000,?,00007FF71B40352C,?,00000000,00007FF71B403F23), ref: 00007FF71B407F32
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectory
                                                                                                                                                                                                                                          • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                          • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                          • Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                                                          • Instruction ID: ca8aae8429c1012cd10dfa49987181e7020156e0bb2541afb74f7145b14b9ea7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B031E821619EC145EA21EB29E4503EAA354EF84BF0F849230EE6D477E9DF3CD6598710
                                                                                                                                                                                                                                          Function 00007FF71B41CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71B41CF4B), ref: 00007FF71B41D07C
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71B41CF4B), ref: 00007FF71B41D107
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 953036326-0
                                                                                                                                                                                                                                          • Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                          • Instruction ID: 598bfea9a83636a9e715a72e8cb334cbca6b887d8fe24489442e608f33decf89
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 78911872F18E5145F710BF2D94402BDABA0BB847A8FA4A135DE4E576A5CF38E469C320
                                                                                                                                                                                                                                          Function 00007FF71B41F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4170891091-0
                                                                                                                                                                                                                                          • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                          • Instruction ID: 7924ec20c0ce96e4624a545281eeebe82128adfcc44197ca4f4df4ba359ed52e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 54513872F0491186EB14FF6899512BCA761ABA0378FA0E235DD1E42AF5DB3CB41B8710
                                                                                                                                                                                                                                          Function 00007FF71B41577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2780335769-0
                                                                                                                                                                                                                                          • Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                                                          • Instruction ID: c359ceaa08c94def46f884cea002265ccea7c8b19178f843e61588614680bb68
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB51C422E14A4189FB10EF79D4503BDB7B1AB88B68F64A435DE0D476A4DF38E4688760
                                                                                                                                                                                                                                          Function 00007FF71B415628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1279662727-0
                                                                                                                                                                                                                                          • Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                          • Instruction ID: ebe5474061586c9bd8ce55725adf12a124862af8969beb115d9e67cf653b59b8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 02418822D18B8183E650AB5895503B9A260FBD47B4F64E335DAAC03AE1DF6CB5B48750
                                                                                                                                                                                                                                          Function 00007FF71B40CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3251591375-0
                                                                                                                                                                                                                                          • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                          • Instruction ID: 8f92c34fc8d2634736826f00b84d440a680664b0e9c45dc3930c3e0bf0551019
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 76313B20E0CA0681FA14BB6CA4513F99281AF91364FC4F034DD4E4B2F3DE2CB42D8279
                                                                                                                                                                                                                                          Function 00007FF71B41013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                          • Instruction ID: 0b53087511af7ee8550b3a9a7992b4d1cde91c8e787cf093cdc96c444b3b45ec
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B51FB21F09A4586E724B92D940067AE291FFC8BB4FA8E735DD6D077E5CE3CF4258620
                                                                                                                                                                                                                                          Function 00007FF71B41C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                                                          • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                          • Instruction ID: f341b1e21b857056ece4f3c5e3e59aa46ff005574359fd0464a79de78939a0e2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DB110821A08F4181DA109B19B800179E351AB81FF0FA49331EE7D4B7F9CF7CE0288704
                                                                                                                                                                                                                                          Function 00007FF71B415924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71B415839), ref: 00007FF71B415957
                                                                                                                                                                                                                                          • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71B415839), ref: 00007FF71B41596D
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1707611234-0
                                                                                                                                                                                                                                          • Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                          • Instruction ID: 2fe4e4de8f192e45bc13a0759e971f15dab5ed3eaf4eccef44c51806fad1a3e3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EA118261A1CA1282EA546F18A41117AF770EB85771FA05235FA9D819E8EF2CE428DB20
                                                                                                                                                                                                                                          Function 00007FF71B41A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RtlFreeHeap.NTDLL(?,?,?,00007FF71B422D22,?,?,?,00007FF71B422D5F,?,?,00000000,00007FF71B423225,?,?,?,00007FF71B423157), ref: 00007FF71B41A95E
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF71B422D22,?,?,?,00007FF71B422D5F,?,?,00000000,00007FF71B423225,?,?,?,00007FF71B423157), ref: 00007FF71B41A968
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                                                          • Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                          • Instruction ID: 4ac00c08dd946f7b3b0c2df31382e186b652d1bfa5084da5b2723d2fd772be93
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A3E04F50E19A0242FE097BF964851389291AFC4B20FD4A430CD1D822B1DE2C78A98A30
                                                                                                                                                                                                                                          Function 00007FF71B41AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CloseHandle.KERNELBASE(?,?,?,00007FF71B41A9D5,?,?,00000000,00007FF71B41AA8A), ref: 00007FF71B41ABC6
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF71B41A9D5,?,?,00000000,00007FF71B41AA8A), ref: 00007FF71B41ABD0
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 918212764-0
                                                                                                                                                                                                                                          • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                          • Instruction ID: 6034a6c3fb3fdcf6fe68e0be6caea6a4af82a2d3b50f4d15ed89c19e5a836b02
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E6218321F18E8241FA54A7A9945437992C29FC47B0FA4E235DE3E477F1CE6CB46D4220
                                                                                                                                                                                                                                          Function 00007FF71B41BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: cbeb3b5568c01fe22c816fd393b22aefbfa64644ae8ce1fe3b0dc090283c3b2e
                                                                                                                                                                                                                                          • Instruction ID: 793be386df3350dff9b3ddc4402a180c8c37cc313755d99e889ccb1c4c6de3d0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cbeb3b5568c01fe22c816fd393b22aefbfa64644ae8ce1fe3b0dc090283c3b2e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4241B632D18A4587EA34EA1DA540179B3A1EB95760FA0A131DE9EC36F1CF2CF416CB61
                                                                                                                                                                                                                                          Function 00007FF71B407F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 840049012-0
                                                                                                                                                                                                                                          • Opcode ID: 12c7421bf9d851de3930d973ff4776f23e58c204998b3b00b1158df84cf7151e
                                                                                                                                                                                                                                          • Instruction ID: ddf1a94dfb38aab585d1cb13e8e637551eff3f6be0198bfde7fe990a0d26baf9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12c7421bf9d851de3930d973ff4776f23e58c204998b3b00b1158df84cf7151e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7421A221B18E5146FA10BA2A6A043FAD741BF85BE4FC9A430EE4C07796CE7DE069C710
                                                                                                                                                                                                                                          Function 00007FF71B41B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                          • Instruction ID: 104e5d7504d386a7e7ec837aedc61477081ced847f11b03c9341273989ecddc2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E6316322E28E1185F611BF59844137CA6A0ABC0BB0FE1A135ED1D533E2DE7CB56A8731
                                                                                                                                                                                                                                          Function 00007FF71B415F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction ID: aa9ab9af353c416b52d33a45bab82cc11c04b60beafa58b17cb4b279a82ad2d1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A8114221E1CA4181EA60BF1994001B9E2A4BFC5BA4FE8A431EF4C57AB6DF3DF4254760
                                                                                                                                                                                                                                          Function 00007FF71B426354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                          • Instruction ID: 2da00a67bf677f79e99d5a48e6e406e0583c1457d0237cd753a473151b098ef7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9B216832A18E4186DB61AF1CE440379B6A0FB84B64FA49234EE5D476E5DF3CD425DB10
                                                                                                                                                                                                                                          Function 00007FF71B4103BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction ID: 1430eb5f22e334e2810939ad4b8a4d3fe18e19d8cb3af9d888bf8f1c68ad8931
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E1017021F08B6540E904AB5A99411A9E691EBC5FF0F989631DE5C27BE6CE3CF4258710
                                                                                                                                                                                                                                          Function 00007FF71B417EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
                                                                                                                                                                                                                                          • Instruction ID: 886b023cc9ebd766f852aa03a503a251dde4bba383dc7091967a4f679cb81dcc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 93015B60E1DE8240FA50BB29A54117A96A0AF847B0FE4E635EE1D426E6DE2CB4794220
                                                                                                                                                                                                                                          Function 00007FF71B418238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                          • Instruction ID: 8161ab029e87090ba5a92153a444b81fd7b31011b743f93f25cd6d97d36fea63
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E1E08C90E0CE0287FA123AAC44821B892604FD5360FF0E030EE08073E3DD6C787D5632
                                                                                                                                                                                                                                          Function 00007FF71B41EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,00000000,00007FF71B41B32A,?,?,?,00007FF71B414F11,?,?,?,?,00007FF71B41A48A), ref: 00007FF71B41EBED
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                                          • Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                          • Instruction ID: a24ae03e12b075c5b24af8bbf257f23ff1c34c8c7da843570cf09d5cf06aafe1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 94F04958F49A0241FE68B66E98512B492905FC8BA0FECE530CD0F863E1EE1CF4A94230
                                                                                                                                                                                                                                          Function 00007FF71B41D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,?,00007FF71B410C90,?,?,?,00007FF71B4122FA,?,?,?,?,?,00007FF71B413AE9), ref: 00007FF71B41D63A
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                                          • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                          • Instruction ID: 5e0b0ff077b39f839bb419a5f1358e8dc746754a2c0cde3ffc8e7a06331219a7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 77F08290F08A0345FE54377D584127492905FC47B0FE8E730DD6E862E1DE2CB4B89530

                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                          Function 00007FF71B4083C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,00007FF71B408919,00007FF71B403FA5), ref: 00007FF71B40842B
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF71B408919,00007FF71B403FA5), ref: 00007FF71B4084AE
                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,00007FF71B408919,00007FF71B403FA5), ref: 00007FF71B4084CD
                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(?,00007FF71B408919,00007FF71B403FA5), ref: 00007FF71B4084DB
                                                                                                                                                                                                                                          • FindClose.KERNEL32(?,00007FF71B408919,00007FF71B403FA5), ref: 00007FF71B4084EC
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF71B408919,00007FF71B403FA5), ref: 00007FF71B4084F5
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                          • String ID: %s\*
                                                                                                                                                                                                                                          • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                          • Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                          • Instruction ID: f239c0c61cf28700896f9e3e96cdfb1c163bf024ac25e935fb35d4beaa1b1f8b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA415321A0CE5295FA20BF28E5441FAA360FB947A4FC0A231DD9D426E4EF3CE56DC751
                                                                                                                                                                                                                                          Function 00007FF71B40D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3140674995-0
                                                                                                                                                                                                                                          • Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                          • Instruction ID: 7c21625e2e97dddcb85278f22cd55ea990078f7ba0dd6e9fdb2c23daf8b32a85
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4F31FA72608F8186EB609F64E8843EEA364FB84754F84903ADE4E47AA4DE38D5598720
                                                                                                                                                                                                                                          Function 00007FF71B421874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2227656907-0
                                                                                                                                                                                                                                          • Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                          • Instruction ID: e13239fd3adfc7c0f9ac5eb56a7b69a21f130055ce6e085606c41fc419bd2fcc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E0B10C29B18E8241EA61BB2BE5002B9E3A0EF44BF0F94E171DD5D07BA5DE3CE459D310
                                                                                                                                                                                                                                          Function 00007FF71B405830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B405840
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B405852
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B405889
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B40589B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B4058B4
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B4058C6
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B4058DF
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B4058F1
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B40590D
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B40591F
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B40593B
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B40594D
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B405969
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B40597B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B405997
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B4059A9
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B4059C5
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF71B4064CF,?,00007FF71B40336E), ref: 00007FF71B4059D7
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                          • API String ID: 199729137-653951865
                                                                                                                                                                                                                                          • Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                          • Instruction ID: ad31b19a0bbdc8e39e30ec7297c4d4f8820a27d39dac79ef1502999c080ddf50
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 85228F64A0DF0791FA19BB9DB8905B4A2A0EF04765BD4F075CC1E42271EF7CB17CA2A4
                                                                                                                                                                                                                                          Function 00007FF71B4081D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B409390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF71B4045F4,00000000,00007FF71B401985), ref: 00007FF71B4093C9
                                                                                                                                                                                                                                          • ExpandEnvironmentStringsW.KERNEL32(?,00007FF71B4086B7,?,?,00000000,00007FF71B403CBB), ref: 00007FF71B40822C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B402810: MessageBoxW.USER32 ref: 00007FF71B4028EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                          • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                          • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                          • Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                          • Instruction ID: 5411cd10944baaec5007f344a1ed67b5ddfe49cbffb9e50e5726cce50a942ad5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F516311A28E4341FA50BB2CA9516F9E350AF947A0FD4E435DE4E826F5EE3CE42C8720
                                                                                                                                                                                                                                          Function 00007FF71B402180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                          • String ID: P%
                                                                                                                                                                                                                                          • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                          • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction ID: 8da0814850b967155f697e334e2412a01d1b381e1cdfd03887d462c76f812b4f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3951F826604BA186D634AF26F4581BAF7A1F798B61F008125EFDE83694DF3CD059DB20
                                                                                                                                                                                                                                          Function 00007FF71B4080C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                          • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                          • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                          • Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                          • Instruction ID: 713edbe5cb716cacb09665622041118d8ec06286d7f525e0cc5225f67bc7d396
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA218821B08E4281FB456B7DB944179A360EF84BB0F98E271DE1D873F5DE2CD5699220
                                                                                                                                                                                                                                          Function 00007FF71B416290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: -$:$f$p$p
                                                                                                                                                                                                                                          • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                          • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction ID: e6b52fc18f5ca985346de45d99556a6bb3de40f1e0491775d5036c40522d834e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E012A262E09A4386FB207E1CD104279B661FBD0760FE4D135FE99066E4DB3CF5A88B24
                                                                                                                                                                                                                                          Function 00007FF71B401050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: d887d44ea8411714a319a2ddb58e34d6532429a931d40157cb204db5ad1c3ab0
                                                                                                                                                                                                                                          • Instruction ID: 5c316708ff5cbabb3acac81d8b33698dbb8c0e026ea173f2dccff2d8c66e79ee
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d887d44ea8411714a319a2ddb58e34d6532429a931d40157cb204db5ad1c3ab0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B3419721B0895241EA14FB1AA8005F9E391FF88BE4FD4E432ED4C477A5DE3CE5598760
                                                                                                                                                                                                                                          Function 00007FF71B401470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: 04eae6a6e28014538c265d314aaf186d5e7ccf6377acaf4908732b6d0be74f73
                                                                                                                                                                                                                                          • Instruction ID: 98e6ab2570e7463e12d14e3c5f23df9c5d9b717b72e756b0902adb8e0cd4b527
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 04eae6a6e28014538c265d314aaf186d5e7ccf6377acaf4908732b6d0be74f73
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 53418221B08E4285EB10FB2AA4415F9E390EF847A4FD4E432ED4D47BB5DE3CE5698724
                                                                                                                                                                                                                                          Function 00007FF71B40EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                          • String ID: csm$csm$csm
                                                                                                                                                                                                                                          • API String ID: 849930591-393685449
                                                                                                                                                                                                                                          • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                          • Instruction ID: b9535d3e3819a5e37978eec849c4a642fb37d87bfb086e6f9592e6c3e7b96282
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9DD17232D08B4586EB20EB29D4403EDB7A0FB557A8F50A135DE4D57B65CF38E0A9C750
                                                                                                                                                                                                                                          Function 00007FF71B41ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF71B41F0AA,?,?,000001F0B28E7B48,00007FF71B41AD53,?,?,?,00007FF71B41AC4A,?,?,?,00007FF71B415F3E), ref: 00007FF71B41EE8C
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF71B41F0AA,?,?,000001F0B28E7B48,00007FF71B41AD53,?,?,?,00007FF71B41AC4A,?,?,?,00007FF71B415F3E), ref: 00007FF71B41EE98
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                          • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                          • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                          • Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                          • Instruction ID: 4642d71e6d84719bb5ac0c2481137e55cc82ca6875788eaaf0fe207d8227a22a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4B41E525F59F1251EA25EB1AA800675A291BF88BF0FD8E135DD1D877A4DF3CF42D8220
                                                                                                                                                                                                                                          Function 00007FF71B402C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF71B403706,?,00007FF71B403804), ref: 00007FF71B402C9E
                                                                                                                                                                                                                                          • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF71B403706,?,00007FF71B403804), ref: 00007FF71B402D63
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF71B402D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                          • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                          • Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                          • Instruction ID: db4b03ccc435aaa0d65172c30afb2986e1bed8e0ac0e54d9c8602b945ca3c462
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7C31FA22708F5142E620BB19B8102EBA691BF847A4F809135EF4D937A9DF3CD55EC710
                                                                                                                                                                                                                                          Function 00007FF71B40DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF71B40DF7A,?,?,?,00007FF71B40DC6C,?,?,?,00007FF71B40D869), ref: 00007FF71B40DD4D
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF71B40DF7A,?,?,?,00007FF71B40DC6C,?,?,?,00007FF71B40D869), ref: 00007FF71B40DD5B
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF71B40DF7A,?,?,?,00007FF71B40DC6C,?,?,?,00007FF71B40D869), ref: 00007FF71B40DD85
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF71B40DF7A,?,?,?,00007FF71B40DC6C,?,?,?,00007FF71B40D869), ref: 00007FF71B40DDF3
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF71B40DF7A,?,?,?,00007FF71B40DC6C,?,?,?,00007FF71B40D869), ref: 00007FF71B40DDFF
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                          • String ID: api-ms-
                                                                                                                                                                                                                                          • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                          • Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                          • Instruction ID: 5d2b53643775b8ff04acea69cc86968447bc9856cf3c162d189171870e8f807e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3231E821B1AE0291EE56AB0AA4006F9A394FF48BB4FD9A535DD5D473A0DF3CE45C8320
                                                                                                                                                                                                                                          Function 00007FF71B406360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                          • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                          • Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                                                          • Instruction ID: 8cfac1cc8d7a589be76aa628f50b6a7348b5d4845ba0dfdbff3504f6d1708b3d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3C419221A18E8791EA21FB28E4141E9A311FF44360FD09132EE5D436E6EF3CE56DC760
                                                                                                                                                                                                                                          Function 00007FF71B402A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF71B40351A,?,00000000,00007FF71B403F23), ref: 00007FF71B402AA0
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                          • Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                          • Instruction ID: 00149876fafece919d2e0ffa3a1f99b491ea1b7288b63ddc4bde6df0bd87a440
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A021B532A18F8182E720AB59B8417E6A394FB883E0F805136FE8C43769DF3CD159C750
                                                                                                                                                                                                                                          Function 00007FF71B41B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
                                                                                                                                                                                                                                          • Instruction ID: 72e73c92ced4415c4c0d68c97187a760666eb9f75866d2951a7dda9e8134391b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D21AF20E0CE4281F969732D9A51239E1825FC47F0FA5E634DC3E866F6DE2CB4298320
                                                                                                                                                                                                                                          Function 00007FF71B41B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF71B414F11,?,?,?,?,00007FF71B41A48A,?,?,?,?,00007FF71B41718F), ref: 00007FF71B41B2D7
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF71B414F11,?,?,?,?,00007FF71B41A48A,?,?,?,?,00007FF71B41718F), ref: 00007FF71B41B30D
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF71B414F11,?,?,?,?,00007FF71B41A48A,?,?,?,?,00007FF71B41718F), ref: 00007FF71B41B33A
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF71B414F11,?,?,?,?,00007FF71B41A48A,?,?,?,?,00007FF71B41718F), ref: 00007FF71B41B34B
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF71B414F11,?,?,?,?,00007FF71B41A48A,?,?,?,?,00007FF71B41718F), ref: 00007FF71B41B35C
                                                                                                                                                                                                                                          • SetLastError.KERNEL32(?,?,?,00007FF71B414F11,?,?,?,?,00007FF71B41A48A,?,?,?,?,00007FF71B41718F), ref: 00007FF71B41B377
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
                                                                                                                                                                                                                                          • Instruction ID: a492a7ef15d3011d0e77f1ed82a16134fa068f65394fe145a986528b6dbf70a4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 20115E20E0DE4682FA587729964113DE1869F847B0FA4E634DC2E866F6DE2CB4798320
                                                                                                                                                                                                                                          Function 00007FF71B402910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF71B401B6A), ref: 00007FF71B40295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                          • Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                          • Instruction ID: 671c70d536e04189b3ccf8af394fc217cfc481b43355b455bd43a081e8bb645e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2031F822B18E8552E710B76AB8402E6A294BF847E4F809135FE8D83765DF3CD55E8610
                                                                                                                                                                                                                                          Function 00007FF71B402390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                          • String ID: Unhandled exception in script
                                                                                                                                                                                                                                          • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                          • Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                          • Instruction ID: 2df7d0d70254c254e214d5ba0e2c1e72d3219f9bf03ef8205d34132150612738
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A6318072A19E8188EB20EF25E8542F9A360FF88794F945135EE4D47BA9DF3CD118C710
                                                                                                                                                                                                                                          Function 00007FF71B402B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF71B40918F,?,00007FF71B403C55), ref: 00007FF71B402BA0
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF71B402C2A
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                          • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                          • Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                          • Instruction ID: ecf18ec714ce7bf09f1aa884081fff30a6d6d749a93f1a6c9460f17f05b2ce8f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F521E562718F4182E710AB18F4407EAB364FB88790F809135EE8D97766DF3CE229C750
                                                                                                                                                                                                                                          Function 00007FF71B419A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                          • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                          • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                          • Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                          • Instruction ID: 53b4766b03349dad7848097f73d9e13ea186d4643c9d2e4f178ff8acc4dbefed
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 82F06825B09F0681EE14AB18F484379A320BF857B1F94A235DD6E451F4DF2CE05DD360
                                                                                                                                                                                                                                          Function 00007FF71B429368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _set_statfp
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1156100317-0
                                                                                                                                                                                                                                          • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction ID: 9da7a2c1815ff12d88d5aec906309c274cfcb16f5247e011085ebb9f289dbf3b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5611C83AD4CE4301FA54355DF4913799040AF9C3F0E84E6B4FE6E462F6CEAC64696120
                                                                                                                                                                                                                                          Function 00007FF71B41B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FlsGetValue.KERNEL32(?,?,?,00007FF71B41A5A3,?,?,00000000,00007FF71B41A83E,?,?,?,?,?,00007FF71B41A7CA), ref: 00007FF71B41B3AF
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF71B41A5A3,?,?,00000000,00007FF71B41A83E,?,?,?,?,?,00007FF71B41A7CA), ref: 00007FF71B41B3CE
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF71B41A5A3,?,?,00000000,00007FF71B41A83E,?,?,?,?,?,00007FF71B41A7CA), ref: 00007FF71B41B3F6
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF71B41A5A3,?,?,00000000,00007FF71B41A83E,?,?,?,?,?,00007FF71B41A7CA), ref: 00007FF71B41B407
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF71B41A5A3,?,?,00000000,00007FF71B41A83E,?,?,?,?,?,00007FF71B41A7CA), ref: 00007FF71B41B418
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
                                                                                                                                                                                                                                          • Instruction ID: 3bc92b5eeb552daf5dea722d603e2c4cb1238ddc760c3e718214a272ae664664
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 22117220E09E1241F964B72D9641179E1515FC47B0FE8E334DD3D966F6DD2CF47A8220
                                                                                                                                                                                                                                          Function 00007FF71B41B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
                                                                                                                                                                                                                                          • Instruction ID: 299cbd6ce5593c4ec995983c933450df063c7e035afcfe7387ed5fa3020bbc67
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A0114820E49E0341F969B26D441517EE1824FC6370FA8EB34DD3E8A6F2DD2CB46E4232
                                                                                                                                                                                                                                          Function 00007FF71B415FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: verbose
                                                                                                                                                                                                                                          • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                          • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction ID: 4dc64594c5a49c5aeb66db653e14aa448e93e9527849d93c5e62c9e6575120d5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3E91B222E08E4681E761AE28D45037DB795AB80B64FE4D136EE5D433E6DF3CF4698321
                                                                                                                                                                                                                                          Function 00007FF71B41FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                          • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                          • Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                          • Instruction ID: f801035772a71bef913d68665fdecc1a899b77c4ca1ce02239ad3b77a2eef87c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9881C972D08E4395F764BE2D8140278A6A0ABB1764FF5E035CD0A476B5DB2CF42B9321
                                                                                                                                                                                                                                          Function 00007FF71B40F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm$csm
                                                                                                                                                                                                                                          • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                          • Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                          • Instruction ID: 2e5e1bf281c1d779deac6edb4ec5cb982e67c4bde158fcd044c261435169ff91
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 04519532A08B4286DB74BB2994842E8B790FB54BA4F94A135DE4C47BA5CF3CE479C711
                                                                                                                                                                                                                                          Function 00007FF71B402810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message
                                                                                                                                                                                                                                          • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                          • Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                          • Instruction ID: ac78583e1ef3c6b1782cb1925a7dbdfd04105c698a97a178385a1c2d9b1623c7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A821A362B18F4192E710AB19F4447EAA364EB88790F809135EE8D93766DE3CE269C750
                                                                                                                                                                                                                                          Function 00007FF71B4020C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1956198572-0
                                                                                                                                                                                                                                          • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction ID: e56c7a9cb01bc5dad878000eb5d9cdc4062cf38ee1d4d2165635af2d4674c151
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C011AC21B1C95242FA54A76EF5842FA9251EF847A0FC4E030DF4907BE9CD2DE5A99210
                                                                                                                                                                                                                                          Function 00007FF71B40D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                                                          • Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                          • Instruction ID: d5458e7f7637de6ecdd5a87564cdda02a6fd73eb34cedf011114131403b230a0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C114C22B14F158AEB009B64E8442B973A4FB19768F841E31DE6D867B4DF3CD1698360
                                                                                                                                                                                                                                          Function 00007FF71B425B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: ?
                                                                                                                                                                                                                                          • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                          • Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                          • Instruction ID: 6c0c7baa43683514b171ebaaf136b0cc09192a2a97d4c20f3a4da57c23efc521
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6C414B12A18A8241F720AB2AF401379E790EB80BB4F94D275EE5D06BF5DF3CD4A5C750
                                                                                                                                                                                                                                          Function 00007FF71B419014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _invalid_parameter_noinfo.LIBCMT ref: 00007FF71B419046
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B41A948: RtlFreeHeap.NTDLL(?,?,?,00007FF71B422D22,?,?,?,00007FF71B422D5F,?,?,00000000,00007FF71B423225,?,?,?,00007FF71B423157), ref: 00007FF71B41A95E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF71B41A948: GetLastError.KERNEL32(?,?,?,00007FF71B422D22,?,?,?,00007FF71B422D5F,?,?,00000000,00007FF71B423225,?,?,?,00007FF71B423157), ref: 00007FF71B41A968
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF71B40CBA5), ref: 00007FF71B419064
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          • C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe, xrefs: 00007FF71B419052
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe
                                                                                                                                                                                                                                          • API String ID: 3580290477-261468487
                                                                                                                                                                                                                                          • Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                          • Instruction ID: b8b8c6416b9b52f58476c94f6aa503bf39eeb1bd7400c6d0e0ec1eac4e00423d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F416335E08E0285F715BF29D8400B9A7A4EB857A0BA5A035ED4D47B65DE3CF4AAC720
                                                                                                                                                                                                                                          Function 00007FF71B41CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                          • String ID: U
                                                                                                                                                                                                                                          • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                          • Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                          • Instruction ID: 5842fcf1fad98a9e0d7751cc19098b2ef6042ce54dc811ed4a1f95396d0875b5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1241C732B18F4181DB20AF29E8443A9A761F788794F949131EE4D877A5EF3CE415C754
                                                                                                                                                                                                                                          Function 00007FF71B42073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 0000000C.00000002.3685198921.00007FF71B401000.00000020.00000001.01000000.00000052.sdmp, Offset: 00007FF71B400000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685124269.00007FF71B400000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685273361.00007FF71B42B000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B43E000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685360980.00007FF71B442000.00000004.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 0000000C.00000002.3685450445.00007FF71B444000.00000002.00000001.01000000.00000052.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_12_2_7ff71b400000_Payload.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                                                          • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                          • Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                          • Instruction ID: a7c1a02ba69f153671f70e031bb430d0e3ad48fbfe9620537a16458fda18e721
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8F018811D18A0285F730BF58A46127EA3E0EF88764FD4A075DD4D427B5DE2CE5289F24